EU-US data-sharing deal comes into force amid threats of legal challenge

Receive free technology regulation updates

we will send you one myFT Daily Digest Latest Email Rounding technology regulation News every morning.

The European Union said a new transatlantic data-sharing agreement would enter into force on Monday, a move designed to reassure thousands of companies over transfers of personal information between Europe and the US, even as the measures face legal challenges. Lie down

The European Commission said a recent executive order issued by US President Joe Biden imposed new obligations on the transfer of data between regions, providing adequate privacy protections for European citizens.

Commission officials said its decision means global companies can safely transfer data in accordance with the new regime, which includes requirements for the responsible handling and deletion of personal information.

The European Court of Justice in 2020 rejected a previous EU-US data-sharing deal, known as the privacy shield, saying the agreement did not limit access to data by US authorities in the same ways that the EU There were “equivalents” of the laws. Europe’s General Data Protection Regulation (GDPR). The same court had previously struck down a similar data transfer arrangement, known as the Safe Harbor, in 2000.

The US has sought to revive the transatlantic data-sharing arrangement, as thousands of organizations including tech companies, banks, law firms and car makers rely on the privacy shield to move data smoothly between the two regions.

Biden’s executive order included new privacy guarantees, including a requirement to delete personal data when it is no longer needed, protections when such information is shared with third parties, and protections for EU citizens from their personal data. The possibility of seeking damages for being treated unfairly was included.

Officials said the EU conducted its own assessment and decided unilaterally that the latest US concessions were legally sound and provided adequate safeguards.

EU Justice Commissioner Didier Reynders said: “I have worked tirelessly with my US counterparts to address the concerns identified by the Court, and ensure that technological advances do not come at the expense of the trust of Europeans. But as close like-minded partners, the EU and the US can find solutions based on their shared values ​​that are both valid and practical in their respective systems.

Activists have said the agreement is flawed, with privacy campaigner Max Schrems, who previously challenged data-sharing agreements between the US and the EU, among those threatening legal action against the new framework.

“They say the definition of insanity is doing the same thing over and over again and expecting a different result,” Schrems said. “Like the privacy shield, the latest deal is based not on material changes but on political interests.”

The implementation of the new EU-US transfer arrangement will be subject to periodic review to ensure that it is effective. The first review is due within one year of the entry into force of the adequacy decision.