During President Biden's trip to Brussels this week to meet with EU leaders, he and European Commission President Ursula von der Leyen reached an agreement that will have tech companies everywhere breathing a sigh of relief. Together on Friday, they announced an agreement in principle on a new framework for transatlantic data flows.
This agreement is critical for tech companies including giants such as Google and Meta, which rely on being able to transfer data between Europe and the US in order to function properly. Back in February, Meta warned that if a new agreement wasn't reached, it may have no choice but to pull out of Europe, after the former pact, known as Privacy Shield, became defunct.
"With concern growing about the global internet fragmenting, this agreement will help keep people connected and services running," said Meta's President of Global Affairs Nick Clegg said in a tweet on Friday. "It will provide invaluable certainty for American & European companies of all sizes, including Meta, who rely on transferring data quickly and safely."
Back in July 2020, Europe's top court ruled Privacy Shield invalid. Judges expressed concerns that Privacy Shield certification didn't adequately protect the data of European citizens from US surveillance activities in the same way they're protected in the EU. Essentially, there was no guarantee that privacy protections provided for by law within the EU can be upheld when people's data travels to the US.
Following his inauguration, Biden immediately appointed a lead negotiator to work on reestablishing data flows between the US and EU. Data transfers have been allowed to continue while a new agreement is worked on, thanks to a mechanism known as standard contractual clauses. But even this process is at risk, due to a ruling by the Irish data protection agency in August 2020. A final decision on the legality of using standard contractual clauses for data transfers is due is the coming months.
Pleased that we found an agreement in principle on a new framework for transatlantic data flows.
— Ursula von der Leyen (@vonderleyen) March 25, 2022
It will enable predictable and trustworthy 🇪🇺🇺🇸 data flows, balancing security, the right to privacy and data protection.
This is another step in strengthening our partnership. pic.twitter.com/7Y0wslR7Go
The agreement in principle may have arrived just in the nick of time, but it doesn't yet amount to a replacement for Privacy Shield. This will need to hammered out quickly in the months ahead, to ensure Meta and other companies relying on data flows to continue their operations.
Biden and von der Leyen didn't share any details about the new deal on Friday, other than to say it safeguards privacy and civil liberties. "This is another step in strengthening our partnership," said von der Leyen in a statement. "We manage to balance security and the right to privacy and data protection." In the meantime, negotiations are likely ongoing behind the scenes to try and get a solid new agreement finalized before time runs out on standard contractual clauses.
Lawyer Max Schrems, who succeeded in the legal challenge against both Privacy Shield and its predecessor, the Safe Harbor agreement, said in a statement that a political announcement without solid text seemed to generate even more legal uncertainty in the meantime. Given that there seems to be no effort by the US to overhaul its surveillance laws, he added that he expected to also challenge any new agreement in court once it had been passed.
"It is regrettable that the EU and US have not used this situation to come to a 'no spy' agreement, with baseline guarantees among like-minded democracies," he said. "Customers and businesses face more years of legal uncertainty."
