Status: 10/07/2022 7:47 p.m
US President Biden has signed a decree for a new data protection agreement between the US and the EU. It aims to end a two-year stalemate that was triggered by a ruling by the European Court of Justice.
The US government is laying the groundwork for a much-needed new legal framework for transferring data from Europeans to the US. Among other things, the decree by President Joe Biden provides for stricter requirements for secret services to access information. A central element is also a two-stage mechanism for EU citizens to complain about what they consider to be illegal access.
“This is the culmination of our joint efforts to restore trust and stability in transatlantic data flows,” said US Secretary of Commerce Gina Raimondo. “It will enable a continuous flow of data that supports more than $1 trillion in cross-border trade and investment each year.”
First agreement in March
Last March, the EU and the USA agreed in principle on a new data protection agreement that should enable the transfer of personal data to US digital companies. The European Court of Justice (ECJ) overturned the previous “Privacy Shield” agreement in July 2020 due to allegations of spying.
Specifically, it was about the transfer of data from European Facebook customers to the USA. The court emphasized that the data exporter must check whether the rights of the data subject enjoy an equivalent level of protection in the USA. The US whistleblower Edward Snowden revealed years ago that US secret services and other investigative agencies have extensive access to the data of foreign users.
Requirements for monitoring defined
The decree now signed by Biden stipulates that the surveillance of data streams by the US secret services may only be carried out to achieve “defined national security goals” and protect the “privacy and civil liberties” of all people regardless of nationality and place of residence in need to be considered.
The decree also provides mechanisms for EU citizens who believe they have been “unlawfully targeted by US intelligence activities”. The first tier will be a “civil liberties officer” attached to the US Secret Service Directorate who will review complaints from EU citizens. The second stage is an independent data protection court that can review the official’s decisions.
Corporations threatened to withdraw
The ECJ ruling created great legal uncertainty for companies when it came to data transfer between the USA and the EU. The Facebook group Meta always warns that the online network and Instagram in Europe will probably have to be discontinued if there is no successor plan.
EU Justice Commissioner Didier Reynders welcomed the signing by Biden. It was an “important step in our determination to restore safe and free transatlantic traffic,” Reynders wrote on Twitter.