Daily News
View All NewsEurope – EU and US agree new framework for transatlantic data flows
The European Commission and the United States have agreed on a new framework for transatlantic data flows: the EU-US Privacy Shield. This will place strong obligations on companies handling Europeans' personal data.
The political agreement was approved today by the College of Commissioners with Vice-President Andrus Ansip and Commissioner Věra Jourová of the European Commission instructed to prepare the new framework.
"The new EU-US Privacy Shield will protect the fundamental rights of Europeans when their personal data is transferred to U.S. companies,” Jourová said. “For the first time ever, the United States has given the EU binding assurances that the access of public authorities for national security purposes will be subject to clear limitations, safeguards and oversight mechanisms.”
The EU-US Privacy Shield reflects the requirements set out by the European Court of Justice in its ruling on 6 October 2015, which declared the old Safe Harbour framework invalid. The new arrangement will provide stronger obligations on companies in the U.S. to protect the personal data of Europeans and stronger monitoring and enforcement by the U.S. Department of Commerce and Federal Trade Commission (FTC), including through increased cooperation with European Data Protection Authorities.
"We have agreed on a new strong framework on data flows with the US,” Ansip said. “Our people can be sure that their personal data is fully protected. Our businesses, especially the smallest ones, have the legal certainty they need to develop their activities across the Atlantic. We have a duty to check and we will closely monitor the new arrangement to make sure it keeps delivering.”
In a briefing note published this morning, global legal firm, Osborne Clarke advised: “This announcement isn't an immediate fix for transatlantic data flows and businesses will need to wait for further details and confirmation that the new framework is acceptable to data protection authorities. However, the approach taken sounds like a promising step in the right direction for EU and U.S. businesses that have been grappling with data transfer issues since the Schrems judgement, and it appears to try to remedy the shortcomings of Safe Harbor as identified by the CJEU”.
The new arrangement includes commitments that possibilities under US law for public authorities to access personal data transferred under the new arrangement will be subject to clear conditions, limitations and oversight, preventing generalised access. Europeans will have the possibility to raise any enquiry or complaint in this context with a dedicated new Ombudsperson.
“Today's decision helps us build a Digital Single Market in the EU, a trusted and dynamic online environment; it further strengthens our close partnership with the US,” Ansip said. “We will work now to put it in place as soon as possible."
“Also for the first time, EU citizens will benefit from redress mechanisms in this area,” Jourová said. “In the context of the negotiations for this agreement, the US has assured that it does not conduct mass or indiscriminate surveillance of Europeans. We have established an annual joint review in order to closely monitor the implementation of these commitments."
The new arrangement will include the following elements: Strong obligations on companies handling Europeans' personal data and robust enforcement, clear safeguards and transparency obligations on U.S. government access, and effective protection of EU citizens' rights with several redress possibilities.
However, not everyone is impressed by the agreement. Jan Albrecht, the German MEP who led the European Parliament's negotiations on the new General Data Protection Regulation described it as "a joke" on Twitter.
Ansip and Jourová are set to prepare a draft decision in the coming weeks, which could then be adopted by the College after obtaining the advice of the Article 29 Working Party and after consulting a committee composed of representatives of the Member States. In the meantime, the US side will make the necessary preparations to put in place the new framework, monitoring mechanisms and new Ombudsman.
For the full framework details, click here.