Biden, Von der Leyen, announce agreement ‘in principle’ on transatlantic data flows

US President Joe Biden and European Commission President Ursula von der Leyen declared on Friday (25 March) the two sides had reached a political agreement on international data transfers, a move cautiously welcomed by industry and analysts.

The agreement at the political level, announced at a joint press conference in Brussels, paves the way for a successor to the Privacy Shield deal, which provided the legal framework for transferring personal data to both sides of the Atlantic until it was invalidated by the Court of Justice of the European Union (CJEU) in July 2020.

Since then, EU officials and members of the US administration have been scrambling to find a legal basis for a new agreement. The core issue is the US surveillance laws, which allow intelligence services to access personal data with little scrutiny and no possibility to readdress.

“We managed to balance security and the right to privacy and data protection,” said Commission President von der Leyen. “We have found an agreement in principle on a new framework for transatlantic data flows. This will enable predictable and trustworthy data flows between the EU and US., safeguarding privacy and civil liberties.”

EU-US data transfers at critical risk as ECJ invalidates Privacy Shield

The EU-US Privacy Shield agreement that attempts to guarantee the secure transmission of EU data to the United States, has been declared invalid by the European Court of Justice, in a ruling that will provoke major disruption to transatlantic data flows.

The press conference took place in a political climate of transatlantic unity following a series of summits gathering leaders from the EU, NATO, and G7 to define a common reaction to the Russian invasion of Ukraine.

“It is especially appalling that the US has allegedly used the war on Ukraine to push the EU on this economic matter,” said Max Schrems, the privacy activist behind the two homonymous court rulings. “We expect this to be back at the Court within months from a final decision.”

The announcement was not backed up with a text, and the question remains whether Washington will be willing to prevent its intelligence services from accessing data from EU residents. A few more months are expected to finalise the agreement at the technical level.

“While we have yet to see the details, it seems both sides were working toward a lasting solution. If they wanted a temporary fix, they could have wrapped up talks months ago. Time will tell whether they got there,” said Caitlin Fennessy, vice-president of the International Association of Privacy Professionals.

Industry representatives have reacted positively to the announcement, as the current legal situation has created no little uncertainty for businesses operating on both sides of the pond. Behind the scenes, however, stakeholders wonder what the announcement will mean in practice.

Global data transfer uncertainty undermines EU digital ambitions

Three years after the EU’s flagship GDPR data protection regulation came into force, confusion over international data transfers following the landmark Schrems II ruling is hampering new technologies and jeopardising the bloc’s digital agenda.

A source familiar with the matter told EURACTIV that nothing has really changed, only that a final agreement has been made more certain.

A second source thought that the announcement might result in putting more political pressure on the Commission’s service responsible for the negotiation, “which may or may not be a good thing”.

For Vincenzo Tiani, resident partner at Panetta law firm, already the fact that a US president has thanked the EU for its leadership in data protection is a positive sign, and an overall shift of attitude to privacy matter might be due to a combination of internal and external factors.

“Perhaps the fact that more and more new states in the US are passing national privacy laws has helped to cast this issue in a different light. Also, the introduction of privacy legislation by China, and soon by India, may have prompted Biden to step up to the plate and reinforce his valuable partnership with the European Union,” Tiani said.

However, even if a technical solution is found on the government access to personal data, other thorny issues also need to be addressed.

“Despite all the joy about the new agreement, we also must keep in mind that the transfer of personal data to other third countries on Earth, e.g. China or states in the Arab region, remains problematic,” Stefan Hessel, attorney-at-law at reuschlaw, told EURACTIV.

[Edited by Zoran Radosavljevic]

Read more with Euractiv

DMA: EU institutions agree on new rules for Big Tech

The new EU regulation targeting tech giants will become fully applicable in 2023, following an agreement reached between the EU co-legislators on Thursday (24 March).