Today, March 25, President Biden and EU Commission President von der Leyen announced they have agreed, in principle, to a legal framework that allows for cross-border data transfers between the U.S. and the EU. The thing is, they did not announce the specific details on what the new deal contains. But it’s expected to largely carry over the Privacy Shield’s requirements for how US companies should conduct themselves when handling Europeans’ data.
However, we expect the framework to look different from the Privacy Shield in a couple key ways. Namely, it will allow European citizens to hold U.S. authorities accountable if they feel U.S. surveillance agencies have exceeded their lawful authority to process Europeans’ data. That process would likely happen under the purview of a Data Protection Review Court. Which may give Europeans some pause. Here’s why: That process would likely happen under the purview of a Data Protection Review Court, which President Joe Biden would ostensibly appoint. The EU would much rather have an independent entity that rolls up to the Supreme Court rather than one that’s created as an extension of the executive branch.
Here’s what we mean: You may recall that the initial cross-border framework, Safe Harbor, was deemed invalid by Europe’s highest court back in 2015. The Snowden revelations had just dropped, and the idea that U.S. law enforcement agencies had their paws on a vast amount of data – including data it acquired via U.S. tech giants’ legal obligations to hand it over – didn’t set well. This announcement is good news for both the EU and the U.S. It’s essential the two of us can share data back and forth for the sake of global commerce. But the reality is that nothing has changed with U.S. surveillance policies’ reliance on privately held data, and that makes any new agreement feel tenuous. After all, Privacy Shield replaced Safe Harbor, and the European Court of Justice (Europe’s highest court) struck it down in 2020.
At the time, activist Max Schrems, whose legal challenge against Safe Harbor incited this chaos to begin with, told The Guardian, “It is clear that the US will have to seriously change their surveillance laws if U.S. companies want to continue to play a role in the EU market.”
Given that nothing has changed, many expect Schrems to challenge this latest agreement once he’s got the text in his hands and can start to build an argument to bring back to the court.
Some pundits have expressed that the EU has gained a new appreciation for its transatlantic relationship as a result of the Russian assault on Ukraine. It’s possible European authorities are becoming more willing to work hand-in-hand with U.S. policymakers now to allow for robust cross-border data flows. But it remains unclear whether any new framework will withstand public interest litigation to overturn it as being insufficiently rigorous. Schrems will say that this new privacy framework lacks real teeth because it does not contemplate Congress changing U.S. surveillance policy. Until the European Court of Justice officially rules on whether this new framework will stay or go, U.S. companies will likely still lean on standard contractual clauses and data transfer impact assessments as a fallback method for their cross-border data flows.
Whether you’re sighing with relief that there’s a new agreement (for now) or rolling your eyes, you were equally represented on Twitter this morning. The news dropped in the middle of the night U.S. time. So Americans on the East Coast got a little jolt before we’d even hit the coffee pot this morning.
Here’s a little roundup of reactions across “#PrivacyTwitter” this morning.
Lourdes, like many of us, is skeptical. But she has hope. It’s just so hard to trust, sometimes.
But poor William here is not into the excitement. What’s there to party about?
And not everyone is convinced that the Russian assault on Ukraine has strengthened the political dynamics between the U.S. and the EU. Jules says there were other factors at play.
Joe over at the IAPP says, let’s all just settle down.
Daragh here agrees. It’s too soon. Like the early days of home ownership, you know?