The European Union signed a new agreement on Monday on the privacy of people’s personal information leaking across the Atlantic, aimed at easing European concerns about electronic spying by US intelligence agencies.
The EU-US data privacy framework. The US has an adequate level of protection for personal data, the EU executive commission said. That means it’s comparable to the strict data protection standards of all 27 nations, so companies can use it to move information from Europe to the United States without adding additional security.
US President Joe Biden signed a executive order in October to implement the agreement after reaching a preliminary agreement with the President of the European Commission, Ursula von der Leyen. Washington and Brussels have made an effort to resolve their years-long battle over the security of EU citizens’ data that tech companies store in the US. two prior data transfer agreements They were expelled.
“Personal data can now flow freely and securely from the European Economic Area to the United States without further conditions or authorizations,” EU Justice Commissioner Didier Reynders told a news conference in Brussels.
Washington and Brussels have long clashed over differences between the EU’s strict data privacy rules and the comparatively lax US regime, which lacks a federal privacy law. That created uncertainty for tech giants, including Google and Facebook parent company Meta, raising the possibility that US tech companies will need to keep European data used for targeted ads outside of the United States. .
However, the European privacy advocate who triggered legal challenges over the practice has thrown out the latest deal. Max Schrems said the new deal failed to resolve the core problems and vowed to challenge it in the EU’s top court.
Schrems kicked off the legal saga by filing a complaint about Facebook’s handling of his data after whistleblower Edward Snowden’s revelations a decade ago about how the US government was spying on people’s data and online communications.
Calling the new deal a copy of the old one, Schrems said his Vienna-based group, NOYB, was preparing a legal challenge and hoped the case would return to the Court of Justice of the European Union by the end of the year.
“Simply announcing that something is ‘new’, ‘robust’ or ‘effective’ is not enough before the Court of Justice,” said Schrems. “We would need changes to US surveillance law to make this work, and we just don’t have it.”
The framework, which goes into effect Tuesday, promises strengthened safeguards against data collection abuses and provides multiple avenues for redress.
Under the agreement, US intelligence agencies’ access to the data is limited to what is “necessary and proportionate” to protect national security.
Europeans who suspect that US authorities have accessed their data will be able to file a complaint with a new Data Protection Review Tribunal, made up of judges appointed from outside the US government. The threshold for filing a complaint it will be “very low” and will not require people to prove their data has been accessed, Reynders said.
Business groups welcomed the decision, which opens a legal path for companies to continue cross-border data flows.
“This is a breakthrough,” said Alexandre Roure, director of public policy at the Brussels office of the Computer and Communications Industry Association, whose members include Apple, Google and Meta.
“After years of waiting, businesses and organizations of all sizes on both sides of the Atlantic are finally assured of a durable legal framework that allows for transfers of personal data from the EU to the United States,” Roure said.
In an echo of Schrems’ original complaint, Meta Platforms was hit in May with a Record EU privacy fine of $1.3bn for relying on legal tools deemed invalid to transfer data across the Atlantic.
Meta had warned in its latest earnings report that without a legal basis for the data transfers, it would be forced to stop offering its products and services in Europe, “which would materially and adversely affect our business, financial condition and results of operations”.
