“Successor to Privacy Shield” – EU and US agree in principle on new data protection agreement?!
Today, EU Commission President Ursula von der Leyen and US President Joe Biden announced a “new system” (!) for data exchange between the EU and the US:
The agreement at the political level, announced at a joint press conference in Brussels, is expected to pave the way for a successor to the Privacy Shield agreement for International Data Transfers with the US, which was overturned by the ECJ. The press conference took place in a political climate of transatlantic unity, with EU, NATO and G7 leaders meeting to decide on a joint response to the situation in Ukraine.
But how the core problem – namely, U.S. surveillance laws that allow intelligence agencies to access personal data without reviewing it and without any way to change it – will be resolved remains an open question. The political empty phrase on this from Commission President von der Leyen: “We have succeeded in striking a balance between security and the right to privacy and data protection.” The announcement means that the political and also time pressure for an attempted solution has increased. But it may be doubted that the “clash of cultures” between U.S. surveillance and EU data protection will really be resolved in an ECJ-proof manner.
Obviously, executive decisions of the European Commission and the U.S. President are planned. In any case, an actual “adequacy decision” would take months. Until a legally binding decision, EEA companies cannot rely on a mere announcement to justify International Data Traffic. And everything will probably be challenged – especially before the ECJ.
Overall, this political announcement is likely to lead to even more legal uncertainty for EEA companies.