EU and US reach data transfer agreement to replace defunct ‘Privacy Shield’ – Europe Europe

The EU has just announced an in-principle agreement with the US on a deal to restore transatlantic data flows — which could mean the number of cloud providers plaguing cloud service providers after a landmark July 2020 court ruling overturning the EU-US Privacy Shield. The month of legal uncertainty is over.

European Commission President Ursula von der Leyen told a joint press conference with US President Joe Biden today: “We have reached an agreement in principle on a new framework for transatlantic data flows. The flow of data between the United States is predictable and trustworthy, safeguarding privacy and civil liberties.”

In recent months, legal uncertainty over EU-US data flows has led European data protection authorities to issue orders against the flow of personal data through products such as Google Analytics, Google Fonts and Stripe.

Facebook’s main EU regulator also finally sent a revised draft decision to Meta last month over years of complaints about its EU-US data flow, after the company exhausted its early initial suspension order in the fall of 2020. the appeals process.

Although the social networking giant has not actually been ordered to suspend its EU-U.S. data flows – and if EU regulators agree to suspend enforcement of data transfers following a political deal with the U.S., it may now dodge it entirely. Bullets, as they did when they agreed in principle to the “Privacy Shield,” allowed a grace period for a moratorium on the additional months needed to secure a final agreement and adopt the new EU-US data flow agreement. This is certainly what Meta has been hoping to happen as it tries to delay early execution.

The details of what has been agreed in principle between the EU and the US and how exactly the two sides have managed to close the gap between the still two very different legal systems are unclear. Since the sustainability of the agreement depends precisely on these details, there is little to learn from today’s announcement other than political posturing.

EU Competition Commissioner Vestager warned that Privacy 2.0 was a “high priority” but “not easy to do”. Uncertainty over EU-US data transfers is actually well ahead of 2020 – as a time-honored predecessor agreement, Safe Harbor, was invalidated by Europe’s top court in 2015 over EU privacy and US surveillance laws There is the same core conflict between them. This dynamic means that any alternative agreement faces the daunting prospect of new legal challenges to test how strong it is in ensuring that EU citizens’ rights are adequately protected when their data flows to the United States.

“We managed to strike a balance between security and privacy and data protection,” Von der Leyen said further briefly in a wider press conference. She also described the agreement as ‘balanced and effective’, but No specifics were provided on the actual decision.”

The Commission has very similar sayings about privacy protections (and safe harbors) — until, of course, courts take a very different view. Therefore, a full and final assessment is not and cannot be the responsibility of the European Commission or their US counterparts, only the European Court of Justice can weigh.

Max Schrems, the privacy lawyer and campaigner whose name has become synonymous with the overthrow of the Transatlantic Data Transfer Agreement, also known as Schrems I and Schrems II, was quick to sound skeptical about what was enacted this time around.

Responding to Von der Leyen’s statement on Twitter, he wrote: “Looks like we’ve made another attempt at so-called privacy protection, especially in one area that puts politics above law and fundamental rights, which has failed twice before. . What we’re hearing now is another ‘patchwork’ approach, but no substantive reforms on the US side. Let’s wait for the specific text, but I[首先]Bet it will fail again. “