The new data transfer agreement between the European Union and the United States carries immediate implications beyond the shores of the Atlantic, affecting how data flows through global digital supply chains and setting a precedent for privacy standards in other regions. As businesses in Asia, Africa, and the Americas often rely on transatlantic data routes for cloud services and customer management, the deal’s stability—or its potential legal challenges—will ripple outward, influencing investment decisions and regulatory approaches worldwide.
The European Union and the United States made a breakthrough in their years-long battle over the privacy of data that flows across the Atlantic with a preliminary agreement that paves the way for Europeans’ personal information to be stored in the U.S. President Joe Biden and European Commission President Ursula von der Leyen announced the deal during Biden’s stop in Brussels, while on a European tour amid Russia’s war in Ukraine.
Business groups hailed the announcement, saying it will provide relief to thousands of companies, including tech giants like Google and Facebook, which faced uncertainty over their ability to send data between the U.S. and Europe, which has much stricter regulations on data privacy. Data may be related to employees or customers and users, and companies use it for all types of online advertising, purchases, and communications.
The agreement came hours after EU officials agreed on sweeping new digital rules to rein in the power of big tech companies such as Facebook and Google. “Today we’ve agreed to unprecedented protections for data privacy and security for our citizens,” Biden said.
“This new arrangement will enhance the Privacy Shield framework. Promote growth and innovation in Europe and the United States. And help companies — both small and large to compete in the digital economy.” Von der Leyen said the agreement “will enable predictable and trustworthy data flows between the EU and the U.S., safeguarding the privacy and civil liberties.”
Scope of Data and Industry Reactions
The data includes “any information that we voluntarily provide or generate when using services and products online,” said Alexandre Roure, an official with the tech trade group CCIA. That includes names, ID numbers and geolocation data, online identifiers like IP addresses and emails, and other information that tech companies use to target ads. The deal stems from a complaint filed a decade ago by Austrian lawyer and privacy activist Max Schrems, who was concerned about how Facebook handled data transfers. Google said it commended the work by the EU and U.S. to “safeguard transatlantic data transfers.”
Legal Uncertainty Looms
Schrems said the latest deal could get tied up in the courts, because his Vienna-based group NOYB would analyze it in-depth and challenge anything that’s not in line with EU law. “Customers and businesses face more years of legal uncertainty,” Schrems said. The coming months will be critical as regulators on both sides finalize the framework and as privacy advocates scrutinize its details, potentially triggering new legal battles that could reshape how data moves across borders for years to come.
