The transfer of personal data from the EU to the US will now be possible. On Monday July 10, Brussels adopted a new legal framework allowing these flows, a device which is crucial for the digital economy after European court decisions having invalidated the previous ones. The two previous devices (the latest being the “Privacy Shield”, in 2020) had been revoked due to fears of surveillance by American intelligence services.
“The new EU-US personal data protection framework will ensure secure data flows for Europeans and provide legal certainty for businesses on both sides of the Atlantic,” said Ursula von der Leyen, the President of the European Commission. For his part, Joe Biden welcomed a decision which “reflects”, according to him, “the common commitment” of the two partners towards “the strong protection of personal data”.
The appeals blocking the first two measures were brought before the Court of Justice of the EU by Austrian privacy activist Max Schrems. The new text does not convince him any more. This Monday, he announced to take legal action again, considering that the new text did not bring any improvement in terms of the protection of the personal data of Europeans.
“We already have options in the drawers for a new remedy, although we are tired of this game of legal ping-pong. We expect the case to come before the Court of Justice again early next year,” he said.
Not surprising Didier Reynders, the European Commissioner for Justice, who expected new legal battles. “Referring to the Court of Justice seems to be part of the business model of some civil society organizations,” he quipped, in a hint to the Austrian activist’s European Center for Digital Rights (Noyb).
Today, a new framework appears essential for the digital giants, such as Google, Meta and Amazon, who deplored the lack of clear rules in terms of data transfer between the two sides of the Atlantic. Mark Zuckerberg’s group was notably fined a record 1.2 billion euros at the end of May for violating European data protection rules with its social network Facebook.
Since then, companies have resorted to alternative legal solutions, with more uncertain legality, to continue these transfers, while waiting for a more solid and sustainable system.
Ursula von der Leyen and Joe Biden had reached an agreement in principle in March 2022 on a new legal device, supposed to respond to the concerns expressed by justice. The new European legal framework implements this agreement. It provides additional safeguards to ensure that access by US intelligence agencies, in the name of national security, to data collected in Europe and transferred or hosted in the United States is limited to what is “necessary” and “proportionate”.
Digital players welcomed this announcement. “After years of waiting, businesses and organizations of all sizes on both sides of the Atlantic finally have the certainty of having a durable legal framework that allows transfers of personal data from the EU to United States,” said Alexandre Roure, director of public policy at the CCIA, the lobby of tech giants.
“Data flows are the basis of EU services exports to the US worth €1 trillion a year, and this decision will give businesses more confidence to do business and contribute to the growth of our economies,” commented Cecilia Bonefeld-Dahl of DigitalEurope, another industry organization.