EU, US Agree on New Framework for Data Transfers

A new data-transfer agreement between the European Union and the United States was approved on Monday, putting an end to three years of legal uncertainty and restarting the free flow of digital information over the Atlantic.

The accord was effectively sealed when the European Commission published an "adequacy decision," designating the U.S. as a nation with adequate protection for personal data sent there from Europeans.

The agreement, dubbed EU-U.S. After the EU's top court invalidated two earlier accords due to concerns about U.S. intelligence agencies spying, the Data Privacy Framework restores transatlantic exchanges that support billions of dollars in digital trade.

On July 3, the U.S. government said that it had completed all of the conditions of the deal. According to a record of the vote, the majority of EU nations also officially supported the initiative last week, with 24 unnamed capitals voting in favor and 3 abstentions.

The Privacy Shield

The EU-US Privacy Shield was a data-transfer agreement between the European Union (EU) and the United States (US). It was designed to allow businesses in the US to transfer the personal data of EU citizens to the US without violating the EU's General Data Protection Regulation (GDPR).

(Photo: FREDERICK FLORIN/AFP/GettyImages) Members of the European Parliament take part in a voting session at the European Parliament in Strasbourg, eastern France, on April 19, 2012. A controversial deal enabling the long-term transfer of EU air passenger data to US authorities as part of the global fight against terror was finally approved today in the European Parliament.

The Privacy Shield was adopted in 2016 and replaced the Safe Harbor Agreement, which had been invalidated by the European Court of Justice in 2015. The Privacy Shield was designed to address the concerns of the CJEU by providing stronger safeguards for the protection of personal data transferred to the US.

The Privacy Shield included a number of key provisions, including, companies that wanted to participate in the Privacy Shield had to adopt binding corporate rules (BCRs) that set out how they would protect personal data transferred to the US.

EU citizens had the right to access their personal data that was transferred to the US under the Privacy Shield. They also had the right to seek redress if their personal data was mishandled by a company participating in the Privacy Shield.

The Privacy Shield was widely criticized by privacy advocates, who argued that it did not provide adequate protection for the personal data of EU citizens. In 2020, the CJEU invalidated the Privacy Shield, ruling that it did not offer an adequate level of protection for personal data transferred to the US.

In the wake of the CJEU's decision, the EU and US are currently in negotiations to reach a new data-transfer agreement. The new agreement is expected to address the concerns of the CJEU and provide stronger safeguards for the protection of personal data transferred to the US.

The new agreement is now called the EU-US Data Privacy Framework.