The US offers additional guarantees to the EU on data privacy

The president’s decision implements an agreement in principle between the European Union and the United States last March on data privacy. The order introduces new binding protections that give companies greater legal protection when transferring personal data to the United States.

Schrems II

Overcoming the court’s objections in the Schrems II ruling, US intelligence services are not allowed to sift through the data of EU citizens. They can only access data that is truly necessary for national security. A certain proportionality applies here.

Additionally, Biden has rigged a new story mechanism. EU citizens can complain to an authority that ensures that US intelligence agencies respect privacy laws and fundamental rights.

Citizens can appeal against the decision of this authority. They do so in a new independent court completely separate from the government. This Data Protection Review Tribunal (DPRC) can conduct its own investigations and make binding decisions. This seems a big difference with the ombudsman at that time under the privacy shield. That person falls under the US Department of the Interior and does not have the aforementioned powers. The European Commission speaks of significant developments.

A sufficient conclusion

Now that Biden has implemented the deal into US law in principle, the European Commission can take further steps towards final approval of the deal with the US. Once this decision, known as an adequacy decision, is made, data can once again flow freely and securely between companies from the EU and the US. It will take at least another six months for all procedures to be completed within the EU. Also, it cannot be ruled out that the Court of the European Union will intervene despite US concessions.

Meanwhile, the European Commission points out that companies can continue to include model clauses in their commercial contracts. This is the most commonly used mechanism for transferring data from the EU. Last year, the Commission adopted modernized standard communication arrangements that are easier to work with. The Commission notes that the adequacy decision is not the only tool for international data exchange.

Dissociative reactions

Initial reactions to President Biden’s order have been divided. Privacy champion Max Schrems believes that the differences in thinking about privacy between the EU and the US are irreconcilable. The Americans can only comply with the EU’s proportional surveillance concept if they drastically reduce mass surveillance systems for citizens.

The European consumer organization BEUC expresses itself in similar terms. Business representatives responded very positively. IBM believes that the long period of uncertainty for the business is finally coming to an end.