A new agreement has been reached on the transatlantic data flow

The European Union yesterday approved a (Data Privacy Framework) agreement that sets out the framework for data transfer between the EU and the United States and could end three years of legal uncertainty for Facebook, Google and other large technology providers. In the so-called Compliance Decision, the European Commission officially recognizes the USA as a country that properly handles the personal data of Europeans. As a precedent, the US president already limited intelligence agencies’ access there in a decree last fall, and Europeans can also apply to a data protection review tribunal if they feel their data was not collected in the way that was necessary and proportionate from a national security standpoint. The Justice Department finally announced last week that it had ended its compliance under the order.

Thus, the data privacy framework paves the way for lucrative transatlantic data exchange, but the agreement doesn’t necessarily end long-standing barriers. Max Shrems The data protection activist, who brought lawsuits that led to the failure of two previous data agreements between the union and the United States, will now challenge the new agreement in court by the end of August. the Based on a report from Politico His complaint may be brought before the Court of Justice of the European Union in early 2024, by which time the Privacy Shield and Safe Harbor frameworks have been invalidated. According to Sharmus, despite the US changes, the new agreement does not provide sufficient protection for the Europeans, and is even less favorable than its predecessor, if it refers to climate change or international health crises as the basis for collective monitoring.

It’s progress, but that doesn’t make it perfect

But the officials involved in drafting the agreement are optimistic that the data privacy framework will stand the test of time in court: according to Politico Didier Reynders The EU commissioner responsible for law enforcement has made it clear that US intelligence agencies must take into account factors included in the jurisprudence of the European Court of Justice when deciding on access to data, and if so, to what extent. Unsurprisingly, the approval of the deal was also widely welcomed by tech companies, hoping that Europeans’ data would continue to flow unhindered to US servers. For example, Meta previously announced that if a data privacy framework is not in place by mid-October, it will have to shut down its online services such as Facebook and Instagram in Europe.

Based on the paper’s coverage, the vast majority of EU member states formally endorsed the agreement last week, with 24 votes in favor and 3 abstentions. According to current plans, the European Commission will review the data protection framework within a year, and after that every four years it will check how effective data protection measures in the United States are for Europeans. This is likely necessary, given that the European Data Protection Board (EDPB) has described the new agreement as a step forward, but has also expressed serious concerns about it. The European Parliament, whose position, like EDBP, is not binding in this case, has opposed the agreement, according to its position, the data privacy framework still allows for collective data collection.