President Joe Biden signed a life-saving executive order on Friday that lays the foundation for the future of data transfer from the European Union to the United States.
With a slight delay on the calendar (the news was expected at the beginning of the week), Joe Biden has just signed the famous decree implementing the data confidentiality framework between his country and the EU. The American president is thus taking a big step towards a new version of the highly contested Privacy Shield. This will protect the citizens of the European Union from certain interference from across the Atlantic.
A decree which follows the Schrems II judgment which had invalidated the Privacy Shield
This decree comes after the reciprocal commitments on which Joe Biden and the President of the European Commission Ursula von der Leyen agreed last March. It was obviously important for both parties to reach an agreement around a question of… 7,100 billion dollars (or 7.1 trillion dollars).
The decree lays down an important legal basis for transatlantic data flows by responding to concerns raised by the Court of Justice of the European Union “, specifies the White House. Indeed, if the Privacy Shield was initially recognized as offering a sufficient level of protection for personal data transferred from the EU to the United States, the CJEU had challenged this position by annulling the decision of Brussels, on June 16 2020. This is the famous judgment Schrems II.
The executive order signed this Friday, October 7 by President Biden therefore reinforces the guarantees of confidentiality and civil liberties for the intelligence activities of the United States. More concretely, this decree will limit the ability of US security and intelligence agencies to access the personal data of European Union citizens that would be transferred to the United States.
Guarantees, but also the possibility of legal action introduced
Thanks to the additional guarantees provided by the text, the American intelligence services will only be able to access the transferred data in the event of absolute necessity, such as in the case of a real threat to national security. Alone, these guarantees could be subject to various interpretations, or even abuse. But a whole arsenal accompanies them.
For example, potentially harmed citizens will be able to take action against the US Department of Justice and sue for redress. These lawsuits will go through a review conducted by an independent body, whose judges must have no ties to the US government and must be real specialists in the question of personal data. This body should be the Data Protection Review Tribunal, which will be specially created. U.S. intelligence agencies will be required to update their policies and procedures to align with the elements of the executive order.
This decree is the last major step in the establishment of a new transatlantic data sharing agreement. It is now necessary for companies (both large and small) concerned with the transfer of information. The European Commission, which has taken note of it, will soon transpose it into its own rules and then impose it on companies. This process could take six months to lead to a final agreement expected in March 2023.
Source : white house
3