US President Joe Biden on Friday signed an executive order allowing progress in the implementation of a new framework for the transfer of personal data from the European Union to the United States, crucial for the digital economy. Washington and Brussels had reached an agreement in principle on this long-standing file in March, previous versions having been challenged by the Court of Justice of the European Union (CJEU) due to fears about American surveillance programs.
European Justice Commissioner Didier Reynders welcomed the signing on Friday. It “marks an important step in our determination to restore safe and free transatlantic data flows”, tweeted the Belgian official.
Today’s signing of the Executive Order by @POTUS marks a significant step in our determination to restore safe & free transatlantic data flows. Thank you @SecRaimondo & AG Garland for the excellent collaboration. We will now start the work for proposing a new #AdequacyDecisionpic.twitter.com/mUTPrvkaTb
— Didier Reynders (@dreynders) October 7, 2022
The signing of the decree by the American president will allow the European Commission to begin its own ratification process, which should take several months.
Ensuring confidentiality and the protection of civil liberties
“This is the culmination of our joint efforts to restore confidence and stability in transatlantic data flows,” US Commerce Secretary Gina Raimondo said during a briefing with reporters. The text reinforces measures aimed at guaranteeing confidentiality and the protection of civil liberties in American surveillance programs targeting data collected in Europe and transferred or hosted across the Atlantic.
Max Schrems considers a new legal action “very likely”
Privacy activist Max Schrems on Friday said legal action against the new framework for the transfer of personal data from the European Union to the United States was “very likely”. “We will probably attack (the text) in court,” he told AFP, citing a probability of “90%”.
“We must first analyze it in detail, which will take us a few days. At first glance, it seems that the central issues are not resolved and the case will be back in court sooner or later,” said- he also responded in a statement.
It also creates an independent and binding mechanism for individuals in eligible states to seek redress if they believe their personal data has been unlawfully collected by US intelligence. This mechanism provides for two levels of appeal, one with an officer in charge of the protection of civil liberties with the American intelligence directorate, the other with an independent tribunal formed by the Department of Justice.
Responding to the Schrems II decision of the CJEU
“These commitments fully respond to the Schrems II decision of the Court of Justice of the European Union and will cover transfers of personal data to the United States under EU law,” said Gina Raimondo. In July 2020, the Court had ruled that the “Privacy Shield”, used by 5,000 American companies, including giants like Google or Amazon, did not protect possible “interferences in the fundamental rights of persons whose data is transferred”.
The case was launched by a complaint against Facebook by Max Schrems, a figure in the fight for data protection, already at the origin of the 2015 judgment on the ancestor of the “Privacy Shield”, “Safe Harbor”. . It is possible that the new version could be challenged again, US administration officials acknowledged during the briefing. But it was designed to meet the previous reservations of European justice, they assured.
The decision of the CJEU had plunged into legal uncertainty companies operating in the EU that transfer or host data across the Atlantic. They have since resorted to alternative solutions, with more uncertain legality, to continue these transfers, while waiting for a more solid and sustainable system.