“Today we’ve agreed to unprecedented protections for data privacy and security for our citizens,” President Joe Biden said. He stood next to European Commission President Ursula von der Leyen in Brussels, on a European tour while Russia’s war in Ukraine continued, and the two announced a preliminary deal on Friday over personal data crossing the Atlantic. It opens the way for Europeans’ personal information to be stored in the United States.
It ends, for now, a fight that has run for years.
Biden called it a new arrangement that would “enhance the Privacy Shield framework, promote growth and innovation in Europe and the United States, and help companies, both small and large, compete in the digital economy.” Von der Leyen said it “will enable predictable and trustworthy data flows between the EU and the U.S., safeguarding privacy and civil liberties.”
How it got here
The dispute began with a complaint filed a decade ago by Max Schrems, an Austrian lawyer and privacy activist. He was worried about how Facebook handled his data after former National Security Agency contractor Edward Snowden revealed U.S. government cybersnooping.
The EU’s top court later struck down Privacy Shield, the agreement covering transatlantic transfers, because it fell short of strict data privacy standards in the 27-nation bloc. Companies then leaned on stock legal contracts to keep data moving. Some scrambled to localize their data or suspend transfers. Facebook faced the prospect of rebuilding its data centers to keep European data out of the U.S.
In a joint statement, the U.S. and EU said the deal answers the court’s concerns. The U.S. will reform its rules on “signals intelligence activities,” meaning intelligence agencies’ collection of emails, text messages and other electronic communications. New safeguards will ensure such surveillance is “necessary and proportionate in the pursuit of defined national security objectives,” the statement said.
Industry reaction
Business groups welcomed the news. Thousands of companies, Google and Facebook among them, had been uncertain whether they could send data between the U.S. and Europe, where privacy rules are far stricter. Nick Clegg, Facebook’s head of global affairs, tweeted that the deal “will help keep people connected and services running.” Google said it commended the work to “safeguard transatlantic data transfers.”
Alexandre Roure of the tech trade group CCIA described what is covered: “any information that we voluntarily provide or generate when using services and products online.” That means names, ID numbers, geolocation data, IP addresses, emails and other details tech companies use to target ads.
The agreement arrived hours after EU officials settled sweeping new digital rules meant to rein in big tech companies such as Facebook and Google.
Schrems is not convinced. His Vienna-based group NOYB will analyze the deal in depth and challenge anything out of line with EU law, so it could end up in court. “Customers and businesses face more years of legal uncertainty,” he said.
