The European Union and the US announced a preliminary data transfer deal on Friday, seeking to end the limbo in which thousands of companies found themselves after Europe’s top court threw out two previous pacts due to concerns about US surveillance.
While businesses cheered the news, Austrian privacy activist Max Schrems, whose campaign about the risk of US intelligence agencies accessing Europeans’ data in a long-running dispute with Meta led to the court vetoes, criticized the lack of details.
President Biden and European Commission President Ursula von der Leyen said at a joint news conference in Brussels that the provisional agreement takes into account the court’s concerns and offers stronger legal protections.
“Today, we’ve agreed to unprecedented protections for data privacy and security for citizens,” Biden said.
“I am very pleased that we have found an agreement in principle on a new framework for trans-Atlantic data flows,” von der Leyen said.
“This will enable predictable and trustworthy data flows between the EU and US, safeguarding privacy and civil liberties,” she added, without elaborating.
An EU official familiar with the matter said it will likely take months to turn the provisional agreement into a final legal deal.
“First, the US needs to prepare their executive order, and then we need to do our internal consultation in the commission and within the European Data Protection Board,” the official said, referring to the EU privacy watchdog.
Companies welcomed the provisional deal.
“Legal certainty about data flows will spur innovation, growth and job creation. This is a win-win agreement for businesses on both sides of the Atlantic,” said Markus J. Beyrer, director of lobbying group BusinessEurope.
“A new agreement will provide companies of all sizes the legal certainty to transfer, analyze and use data on both sides of the Atlantic. The ability to move data is critical in today’s digitally connected economy,” said US Chamber of Commerce executive vice president Myron Brilliant.
Schrems, however, said the lack of details was troubling and that if the United States was only offering executive reassurances instead of changing its surveillance laws, he would not hesitate to go to court again.
“The final text will need more time, once this arrives we will analyze it in depth, together with our US legal experts. If it is not in line with EU law, we or another group will likely challenge it,” he said in a statement.
The latest data accord risks being shot down again if it is not strong enough, said Patrick Van Eecke, a partner at law firm Cooley in Brussels.
“As before, privacy activists will probably try to have this agreement invalidated by the European Court of Justice, and the recent Supreme Court decision in the FBI v. Fazaga case will not make it easier for the US administration to convince Europe that the United States has equally strong privacy protections,” he said.