Biden Signs New Data Transfer Framework to Save U.S.-EU Data Flow

President Joe Biden today signed an executive order that will limit the ability of U.S intelligence agencies to access people’s personal data. It's part of the data sharing commitment Biden and European Commission President Ursula von der Leyden agreed to in March. The EU nullified transatlantic data flow in 2020. As a result, thousands of small and medium-sized firms could no longer transfer personal data across the Atlantic. Meanwhile, the constant tug-of-war between the U.S. big tech companies and EU regulators has led to some extreme claims. “The EU-U.S. data privacy framework includes robust commitments to strengthen the privacy and civil liberties safeguards for signals intelligence to ensure the privacy of EU personal data,” said Gina Raimondo, secretary of commerce, in today’s press call to reporters. The new framework will: Limit U.S intelligence agencies' collection of data only for specific and defined national security purposes.Require U.S intelligence agencies to update their policies and procedures to reflect the new data flow guidelines.Allow Europeans to seek redress through an independent court within the Department of Justice—the Data Protection Review Court—where people can file lawsuits via a “special advocate” to challenge how their data is being used by U.S agencies.Authorize civil liberties protection officials in the Office of the Director of National Intelligence to investigate initial complaints and breaches of people’s privacy rights. Bidens’ decree unlikely to satisfy EU law Certain terms under Biden’s decree are not sitting well with privacy experts like Max Schrems, the Austrian privacy lawyer who advocated for the nullification of the previous Privacy Shield, and chair of the non-profit European Center for Digital Rights (noyb). For example, the term "court” under Biden’s order is not the same “court” under the normal legal meaning of Article 47 of the Charter or the U.S. Constitution, but a body within the U.S. government's executive branch, the non-profit said in a statement. "We have to study the proposal in detail, but at first glance, it is clear that this 'court' is simply not a court. The Charter has a clear requirement for 'judicial redress' - just renaming some complaints body a 'court' does not make it an actual court. The details of the procedure will also be relevant to see if this can satisfy EU law,” said Schrems. What’s next? As the next step, the decree will be sent to the European Commission in Brussels while seeking input from privacy agencies and politicians in the EU. That could take another 6 months with the final pact expected to publish in spring. "The question now is whether the cycles of break and rebuild will become perpetual or whether this new framework might instead serve as a building block for broader multilateral collaboration," said Caitlin Fennessy, vp & chief knowledge officer at the International Association of Privacy Professionals. Fennessy thinks the pact could even lead to change here at home as Congress continues to consider federal privacy regulation. Ad Tech Granted Some Relief With Federal Privacy Bill ‘Dead’ in This Congress