EU-U.S. Data Privacy Framework in Place

The U.S. Department of Justice (DOJ) and the Office of the U.S. National Intelligence Director (ODNI) have declared the fulfillment of their commitments under President Joe Biden's Executive Order (EO) 14086 regarding the EU-U.S. Data Privacy Framework.

Since 2020, when the European Court of Justice nullified the EU-U.S. Privacy Shield agreement due to concerns about U.S. government surveillance activities, the U.S. and the EU have been on a quest to establish a new data flow mechanism. This decision unsettled transatlantic data transfers and necessitated a resolution that would ensure enhanced privacy and data protection for EU data subjects.

Secretary of Commerce Gina Raimondo said in a press statement that the DOJ's designation of EU member states, as well as Iceland, Liechtenstein, and Norway, as "qualifying states." These designations allow citizens of these nations to seek redress through the proposed Data Protection Review Court, offering enhanced U.S. privacy protections in the process.

"These designations represent our shared commitment with our European partners to safeguarding individual rights and personal data protection. They also highlight our dedicated effort to build trusted, secure digital connections that foster economic growth while upholding privacy," Secretary Raimondo stated.

These designations will come into effect upon the European Commission's final approval of the adequacy decision with the U.S, marking a critical milestone in the implementation of the EU-U.S. Data Privacy Framework.

Concurrently, the ODNI released the policies and procedures to be followed by the U.S. intelligence community, reinforcing the U.S. government's commitment to maintain privacy standards and bolster protections for international data transfers.

This new framework addresses two primary concerns expressed by the European Court of Justice related to U.S. surveillance laws: the scope and proportionality of permissible U.S. national security surveillance activities and the availability of redress mechanisms for Europeans whose personal data is improperly collected and used by U.S. intelligence agencies.

Executive Order 14086 introduced added safeguards for U.S. signals intelligence activities, requiring these to take into account the privacy and civil liberties of all persons, regardless of nationality or place of residence, and to be conducted only when necessary and proportionate to a validated intelligence priority.

The Secretary concluded, “The culmination of these efforts signifies a significant stride in data protection and privacy. Our alliance with the EU is stronger than ever, and we eagerly anticipate further collaboration as we continue to enhance our vibrant transatlantic digital economy.”