EU and U.S. Agree “In Principle” on New Data Transfer Framework

The European Commission and the United States government announced that they have come to an agreement “in principle” on a new framework for transatlantic data flows. While the actual status of the framework is unclear, the announcement demonstrates a meeting of minds regarding the key principles to be included in the new framework and serves as a necessary step in creating a lasting and adequate data transfer agreement. The White House fact sheet on the matter identifies several focus areas, including updating safeguards ensuring proportionality of surveillance, ensuring that a robust recourse mechanism is in place for EU data subjects, and adopting effective oversight procedures within U.S. intelligence agencies. U.S. commitments on the new framework will be established in an Executive Order.

Details of exact changes to be made and how these new systems will function remain to be seen, along with whether these changes will be sufficient to support the new Trans-Atlantic Data Privacy Framework against inevitable legal challenges. No timeline has been given for when drafts of the framework will be released. EPIC has supported calls for enhanced privacy protections prior to establishing a new data transfer framework. EPIC also participated as an amicus curiae in the Schrems II case, arguing that U.S. surveillance law does not provide adequate privacy protections or remedies for non-U.S. persons abroad.