The European Commission and the United States have announced that they have agreed in principle on a new Trans-Atlantic Data Privacy Framework, which aims to facilitate trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union in the Schrems II decision in July 2020.
The new Framework’s principles are:
- Data will be able to flow freely and safely between the EU and participating US companies.
- A new set of rules and binding safeguards to limit access to data by US intelligence authorities to what is necessary and proportionate to protect national security; US intelligence agencies will adopt procedures to ensure effective oversight of new privacy and civil liberties standards.
- A new two-tier redress system to investigate and resolve complaints about access to data by US intelligence authorities, including a Data Protection Review Court.
- Strict obligations for companies processing data transferred from the EU, which will continue to include the requirement to self-certify their adherence to the Framework’s principles through the US Department of Commerce.
- Specific monitoring and review mechanisms.
The Trans-Atlantic Data Privacy Framework follows more than a year of negotiations between the US and the EU. It aims to provide a durable basis for trans-Atlantic data flows, which the Statement says are critical to protecting citizens’ rights and enabling trans-Atlantic commerce in all sectors of the economy, including for small and medium enterprises. By advancing cross-border data flows, the new framework aims to promote an inclusive digital economy in which all people can participate and in which companies of all sizes can thrive.
The new Framework also aims to facilitate further US-EU cooperation, including through the Trade and Technology Council and through multilateral forums, such as the Organisation for Economic Cooperation and Development, on digital policies.
The US commitments will be included in an Executive Order that will form the basis of the Commission’s assessment in its future adequacy decision.
