Last month, on 11 July 2023, the European Commission adopted a new pact with the US to streamline the legal transfer of personal data across the Atlantic.
The ‘EU-U.S. Data Privacy Framework,’ or DPF means the end of a period of legal precariousness around the export of EU citizens’ data by US companies. Since the previous deal was ruled unlawful in 2020, the process of transferring data has become increasingly complex and uncertain. In May, for example, Meta (which operates Facebook, Instagram, and WhatsApp) was given a record fine by the EU for not complying with the European framework.
Known as Privacy Shield, the previous agreement was – along with its predecessor, Safe Harbor – dismissed by a top EU court because of concerns over US agencies accessing EU users’ personal data. It was judged that US surveillance powers did not meet the EU’s required legal standard of data privacy. Compared with the EU, the US has more lenient privacy laws and, whilst American citizens are mostly protected from such surveillance, foreigners are not.
The new DPF agreement promises to strengthen data protection measures and align US practices more closely with the EU’s General Data Protection Regulation (GDPR). It pledges that only “necessary and proportionate data” will be collected. It also establishes a mechanism for legal redress for EU users if they suspect their privacy rights have been violated.
The President of the European Commission lauded the pact as “an important step to provide trust to citizens that their data is safe, to deepen our economic ties between the EU and the US, and at the same time to reaffirm our shared values.” Similarly, the US Secretary of Commerce, Gina Raimondo, said: “Trans-Atlantic data flows underpin more than $1trn in cross-border trade and investment per year. The DPF will be a particularly valuable tool for small and medium-size businesses that wish to participate in the transatlantic economy.”
However, data privacy campaigners remain sceptical of any enhanced provision, arguing that there have been no significant changes in US surveillance laws since the previous agreement was dismissed. They have already vowed to object to it in court, meaning that there could be further challenges and uncertainty ahead.