Strengthening Transatlantic Ties | NewData Transfer Agreement Between EU and US

The newly approved EU-U.S. Data Privacy Framework addresses concerns previously raised by the European Court of Justice. It introduces several measures, such as limiting access to EU data by US intelligence services to what is deemed necessary and proportionate. The framework also establishes a Data Protection Review Court (DPRC), accessible to EU individuals.

Notably, if the DPRC determines that data has been collected violating the new safeguards, it can order the data's deletion. This comprehensive approach, coupled with additional obligations for US companies importing data from the EU, represents significant improvements over the old Privacy Shield mechanism.

Under the new framework, US companies can participate by committing to a detailed set of privacy obligations. For example, companies must delete personal data when no longer necessary and ensure continued protection when personal data is shared with third parties.

The new framework provides several recourse avenues for EU individuals if US companies mishandle their data. These include free independent dispute resolution mechanisms and an arbitration panel. The safeguards also limit data access by US public authorities, particularly for criminal law enforcement and national security purposes, to what is necessary and proportionate.

Privacy advocate Max Schrems, who initiated the legal battles that resulted in the cancellation of prior EU data transfer pacts, is ready to challenge this most recent agreement. Schrems has expressed concerns about the recurring pattern of these agreements, speculating that the current one could meet a similar end.

The US has set up an independent and impartial redress mechanism, including the Data Protection Review Court (DPRC), to address complaints from EU individuals regarding their data's collection and use by US intelligence agencies.

The functioning of the EU-U.S. Data Privacy Framework will be subject to periodic reviews, with the first review expected within a year of the adequacy decision's enforcement. These reviews will be carried out by the European Commission, together with representatives of European data protection authorities and competent US authorities.