EU and US reach agreement on new Data Privacy Shield
Following on from a flurry of recent developments in relation to international data transfers, on 25th March 2022 it was announced that the EU and USA have agreed in principle on a new framework to replace the Privacy Shield which was invalidated by the Court of Justice of the European Union (“CJEU”) in Schrems II.
The much anticipated announcement follows lengthy negotiations between the US and EU which have been ongoing since the decision in Schrems II was handed down in July 2020.
A positive development
The new framework, which is has been dubbed Privacy Shield 2.0, is to be formally known as the Trans-Atlantic Data Privacy Framework (TADPF).TADPF aims to enable free cross-border data flows between the EU and US which safeguard the privacy and civil liberties of transferred EU data. In a press release, the White House announced that safeguards will be implemented to ensure adequate protection to EU personal data against intrusions arising from surveillance activities of US public authorities. This is to address the shortcomings of the former regime, highlighted by the CJEU in Schrems II, where the Court held that the previous Privacy Shield did not protect against data being intercepted by intelligence authorities.
Factsheets published by both jurisdictions clarify that access to EU citizens’ personal data will be proportionate and carried out ‘only where necessary to advance legitimate national security objectives’. Furthermore a multi-layered redress mechanism including an independent Data Protection Review Court will be implemented to safeguard the rights of data subjects.
Although we are awaiting publication of a final legal text; some commentators have already expressed concern that the proposed framework may be struck down again by the CJEU.These concerns may prove be well-founded given that the CJEU has previously twice invalidated data transfer mechanisms between EU and US in Schrems I and Schrems II.
These transatlantic events are being watched closely in the UK as any reinstatement of the EU-US Privacy Shield augurs well for the prospect of the UK and US reaching agreement on international personal data transfers. The UK government has previously made it clear that agreeing new data adequacy partnerships with the US and others is a key priority post Brexit.
If you would like any further information or advice on these issues please contact Laura Cunningham from the Commercial team.