EU and US reach out to a political agreement on Trans-Atlantic Data Privacy Framework

The political communication. 

On March 25^th, 2022, the U.S. President Joe Biden, and the European Commission President Ursula von der Leyen announced in a joint press conference that they reached a political agreement on trans-Atlantic data transfers. “We have found an agreement in principle on a new framework for transatlantic data flows. This will enable predictable and trustworthy data flows between the EU and US., safeguarding privacy and civil liberties,” said the E.U. Commission President Ursula von der Leyen.

 The communication took everybody by surprise and caused strong reactions sprinkled with conspiracy theories and accusation amongst privacy advocates. Truth be told, E.U. officials and members of the U.S. government have been scrambling to find a legal basis for a new agreement since the Court of Justice of the E.U. decided to invalidate the Privacy Shield in July 2020.

  

Fact Sheet

The announcement was backed up with a Fact Sheet released by the White House specifying that “United States has committed to implement new safeguards to ensure that signals intelligence activities are necessary and proportionate in the pursuit of defined national security objectives, which will ensure the privacy of EU personal data and to create a new mechanism for EU individuals to seek redress if they believe they are unlawfully targeted by signals intelligence activities.”

 

Executive order 

Concretely, U.S. Government committed itself to adopt an Executive Order (EO) which will provide the foundation for the E.U. Commission’s assessment of its future adequacy decision. The EO will regulate core issues of the US surveillance laws which today allows intelligence services to access personal data with little scrutiny and no possibility to readdress.

 

Therefore, the EO will create a Data Protection Review Court made up of members chosen from outside the U.S. Government with full authority to adjudicate claims and direct remedial measures. Furthermore, intelligence agencies will adopt procedure to ensure effective oversight of privacy and civil liberties standards. At the same time signals intelligence collection would be undertaken only where necessary to advance legitimate national security objectives, and only if it would not disproportionately impact the protection of individual privacy and civil liberties.

 

Months away from an agreement

The announcement is expected to provide a political boost for reaching a final agreement. However, this might still be months away. “The teams of the U.S. Government and the European Commission will now continue their cooperation with a view to translate this arrangement into legal documents that will need to be adopted on both sides to
put in place this new Trans-Atlantic Data Privacy Framework”, says the White House press release.

As Euractive wites: “The possibility that negotiations eventually break down has been made impossible now, but the political announcement might just put more pressure on the technical level and who knows with what results.”

 

Conclusion

While we are noticing the diversity of reactions coming from privacy professionals and advocates, we cannot but notice and agree that, in the past years, data privacy has been up on the agenda of both states and federal government legislatures in the U.S. And it’s worthwhile mentioning that, although overshadowed by this news, on March 24^th, 2022, Gov. Spencer Cox, R-Utah signed Utah Consumer Privacy Act into law, making Utah the fourth state to pass comprehensive privacy legislation in the U.S.