Political agreement found for new EU-US data transfer deal

The EU Commission announced yesterday that it has finalised negotiations with the United States on a renewed framework for transatlantic data flows of personal data. While the European Commission claims that this will create legal certainty for business, many challenges remain.

Firstly, the agreement, called the EU-US Privacy Shield, has now been reached at a political level and details will still need to be worked out. Some Data Protection Authorities, especially in Germany, are likely to be critical of the arrangement. Also, the agreement is to be concluded by an exchange of letters at the highest political level – something that was not seen as a solid legal basis by MEPs. The pact may be challenged in courts in the future by privacy activists, which would create more uncertainty for business.

The EU Commission says that the deal includes clear safeguards and transparency obligations regarding US government access to personal data in the EU. US Law enforcement and national security organisations will be subject to limitations and oversight mechanisms. The Safe Harbor was mostly criticised by the EU for the lack of enforcement and monitoring. The new system will allow for the EU to monitor the functioning of the arrangement. The EU Commission and the US Department of Commerce will conduct an annual joint review, aided by the EU Data Protection Authorities.

The US Congress is still in the process of adopting the Judicial Redress Act, something which has been seen as a key element in the negotiations by the EU. Last minute amendments are controversial but yesterday’s announcement by the EU Commission said that EU citizens will benefit from redress mechanisms in the area of national security access. A US Ombudsman will be created to deal with complaints from EU citizens.

The next steps are to see the response from the national DPAs, meeting today in Brussels. The Commission now has to adopt a formal ‘adequacy’ decision and get the support from the regulators. The drafting is likely to take some weeks, the Commission says, but is silent on the question of whether existing SH participants can directly ‘transfer’ to the new scheme, and what to do in the meantime.

Follow future developments in data transfers, and more detailed analysis in the PL&B International Report.