EU and US agree data 'Privacy Shield'

The European Union and the United States have agreed on new rules that will allow American companies like Google or Facebook to process personal data from European citizens. The deal will replace the so-called Safe Harbour agreement which was annulled by the European Court of Justice i (ECJ) last year.

The European Commission i announced the deal at a press conference in Strasbourg on Tuesday (2 February).

“We have agreed with our US partners a new framework that will ensure the right checks and balances for our citizens,” said digital commissioner Andrus Ansip i.

“We have for the first time received detailed written assurances from the United States on the safeguards and limitations applicable to US surveillance programmes,” noted Ansip.

The Safe Harbour deal was brought before the ECJ after whistleblower Edward Snowden revealed the extent of US-led mass surveillance programmes.

With American internet services popular among Europeans, the EU side wanted to know if it could still trust the US authorities on data collection.

“The US side has clarified that they do not carry out indiscriminate mass surveillance of Europeans,” said Ansip, adding that the US intelligence activities underwent “substantial internal reviews”.

Special ombudsperson

His colleague, justice commissioner Vera Jourova i, said the written assurances would include one from the office of the director of national intelligence in the White House.

“This is a unique step the US has made in order to restore trust in our transatlantic relations,” noted Jourova, adding that the EU would “hold the US accountable on the commitments they made”.

The deal sees the phrase Safe Harbour replaced by a new name: the EU-US 'Privacy Shield'.

“We decided to rebrand, rename the scheme,” said Jourova.

The framework will also include redress possibilities for EU citizens who feel their data has been misused.

“The US will create the role of a special ombudsperson within the US State Department who would follow up complaints and inquiries by individuals on national security access upon referral by EU data protection authorities,” said Ansip.

In a conference call with journalists, US secretary of commerce Penny Pritzker said they were “tough negotiations”.

“It's been a long road but we've turned a corner and now we stand together,” she said, adding that the new framework would provide certainty to EU and US businesses and citizens alike.

“This new mechanism will allow the digital economy in both the EU and the US to grow, which is so critical to jobs and economic security,” noted Pritzker. She said she was “confident” that the new deal met the requirements of the ECJ.

A senior official at the US department of commerce said the new deal, just like Safe Harbour, was “not a multilateral agreement or a treaty in the formal sense”.

This has already prompted some criticism.

Liberal Dutch member of the European Parliament Sophie in 't Veld i said the “legal status of these safeguards is very unclear”.

“The assurances seem to rely exclusively on political commitment, instead of legal acts. So any change in the political constellation in the US may undo the whole thing,” she said. The deal was announced a day after the 10-month race for the White House kicked off in Iowa.

The American Chamber of Commerce to the European Union is happy with the agreement, however.

“This new framework gives business the necessary confidence to continue to invest in the transatlantic marketplace,” it said in a press release.

Jourova and Ansip will draft a so-called “adequacy decision” in the following weeks to determine if the US commitments provide adequate protection for European citizens' data. The decision is a legal tool under the comitology procedure, whereby decisions are taken by experts from EU countries. Jourova expects the new framework to be in place in three months.