EU makes 3rd attempt at US data agreement

The European Commission hopes it will be a case of third time lucky after formalizing the new legal framework for a data privacy deal with the United States, following the failure of two previous arrangements.

Monday's formalization comes after the initial draft decision was made last December, two months after US President Joe Biden had signed an executive order relating to the matter, in October 2022.

The previous data agreement between the two sides, known as Privacy Shield, was struck down by the European Court of Justice in 2020 because of fears that US intelligence agencies had too much access to the personal data of European citizens.

Commission President Ursula von der Leyen said the new deal was "an important step to provide trust to citizens that their data is safe, to deepen our economic ties between the EU and the US, and at the same time to reaffirm our shared values".

In a question and answer document published by the Commission, the deal was explained "as a result of adequacy decisions, personal data can flow freely and safely from the European Economic Area (EEA), which includes the 27 European Union member states as well as Norway, Iceland and Liechtenstein, to a third country, without being subject to any further conditions or authorizations. In other words, transfers to the third country can be handled in the same way as intra-EU transmissions of data."

But the move has not been greeted with unanimous support. Many members of the European Parliament have been very skeptical through its legislative journey, and data privacy activists have vowed to put up legal challenges.

Max Schrems, the Austrian privacy campaigner whose previous lawsuits have derailed the two earlier deals, has already said he plans to mount a challenge this summer and expects it to reach the European Court of Justice early next year.

"We would need changes in US surveillance law to make this work, and we simply don't have it," the Politico website quoted him as saying. "There are even parts that are worse than before so for example, purposes for mass surveillance now (include) climate change and international health crisis."

But European officials such as Justice Commissioner Didier Reynders have said the new arrangement is "substantially different" to Privacy Shield, and should withstand legal challenges.

"When deciding whether and to what extent US intelligence agencies should access data, they will be required to balance the same factors as those required by the case law of the EU Court of Justice," he added.

The new proposals have had a positive response from tech companies such as Meta, the owner of Facebook, which had previously said that it might have to shut down Facebook and Instagram in Europe if a deal could not be reached before mid-October.

Meta's president for global affairs, Nick Clegg, said the new framework "will safeguard the goods (and) services relied on by people and businesses on both sides of the Atlantic".