Biden signs executive order to implement Trans-Atlantic data privacy framework that lets the EU send citizens’ data to the US
As we reported back in March, The EU and the United States reached an agreement on the new Trans-Atlantic Data Privacy Framework that enables the personal information of Europeans to be stored in the US. The framework, which adopts new American intelligence-gathering privacy safeguards, will pave way for the EU to send citizens’ data to the US.
Fast forward seven months later, U.S. President Joe Biden on Friday finally signed an executive order to implement the new European Union-United States data transfer framework after several years of legal challenges and after Europe’s top court threw out two previous pacts over the concerns about U.S. surveillance.
This signing of the executive order also brings an end to many months of legal tussles. It’s also a major breakthrough in a years-long battle over the privacy of data that flows across the Atlantic that will eventually help pave the way for the personal information of Europeans to be stored in the United States.
The White House said “transatlantic data flows are critical to enabling the $7.1 trillion EU-U.S. economic relationship” and the framework “will restore an important legal basis for transatlantic data flows.”
In July 2020, the EU Court of Justice (CJEU) struck down the EU-U.S. Privacy Shield, a legal framework used by thousands of U.S. technology companies to facilitate data transfers. CJEU said the United States failed to provide adequate protection for data belonging to people from the EU.
The U.S. Supreme Court’s decision this month in FBI v. Fazaga, a case challenging FBI surveillance, will make it significantly harder for people to pursue surveillance cases, and for U.S. and European Union (EU) negotiators to secure a lasting agreement for transatlantic transfers of private data.
Under the new Trans-Atlantic Data Privacy Framework, the US will put in place “new safeguards to ensure that signals surveillance activities are necessary and proportionate in the pursuit of defined national security objectives, establish a two-level independent redress mechanism with binding authority to direct remedial measures, and enhance rigorous and layered oversight of signals intelligence activities to ensure compliance with limitations on surveillance activities.”
According to the Fact Sheet published by the White House, the US has made “unprecedented commitments” that build on the safeguards that were in place under the annulled Privacy Shield framework with the aim of addressing issues identified in the Schrems II decision. The new framework will:
strengthen the privacy and civil liberties safeguards governing U.S. signals intelligence activities through binding safeguards limiting U.S. intelligence authorities’ access to data to what is necessary and proportionate to protect U.S. national security;
establish a new, multi-layered redress mechanism with independent and binding authority composed of individuals chosen from outside the U.S. Government who will have full authority to investigate and adjudicate claims, as well as impose remedial measures, as needed; and
enhance the U.S.’ existing rigorous and layered oversight of signals intelligence activities.
Just like the canceled Privacy Shield, U.S. companies will be mandated to self-certify their adherence to the Privacy Shield 2.0 once it is released. Tech companies and business groups quickly welcome the news saying that “it will provide relief to thousands of companies, including tech giants like Google and Facebook, that faced uncertainty over their ability to send data between the U.S. and Europe, which has much stricter regulations on data privacy.” However, some argued that the personal data of EU citizens could get into the hands of the US 3-letter agencies.
According to the information on the EU website, the new “Trans-Atlantic Data Privacy Framework reflects more than a year of detailed negotiations between the U.S. and E.U. led by Secretary of Commerce Gina Raimondo and Commissioner for Justice Didier Reynders.”