The European Commission and the United States have announced that they have agreed in principle a new Trans-Atlantic Data Privacy Framework, which will foster trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union in the Schrems II decision of July 2020.

According to the Joint Statement, the new Framework marks an “unprecedented commitment on the US side to implement reforms that will strengthen the privacy and civil liberties protections applicable to US signals intelligence activities”.

Under the Framework, the US is to put in place new safeguards to ensure that signals surveillance activities are necessary and proportionate in the pursuit of defined national security objectives, establish a two-tier independent redress mechanism with binding authority to direct remedial measures, and enhance rigorous and layered oversight of signals intelligence activities to ensure compliance with limitations on surveillance activities.

According to the Factsheet, the key principles of the deal are:

• data will be able to flow freely and safely between the EU and participating US companies;
• a new set of rules and binding safeguards to limit access to data by US intelligence authorities to what is necessary and proportionate to protect national security; US intelligence agencies will adopt procedures to ensure effective oversight of new privacy and civil liberties standards;
• a new two-tier redress system to investigate and resolve complaints of Europeans on access of data by US Intelligence authorities, which includes a Data Protection Review Court;
• strong obligations for companies processing data transferred from the EU, which will continue to include the requirement to self-certify their adherence to the Principles through the US Department of Commerce; and
• specific monitoring and review mechanisms.

The Trans-Atlantic Data Privacy Framework reflects more than a year of detailed negotiations between the US and EU. The Joint Statement says that it will provide “a durable basis for trans-Atlantic data flows, which are critical to protecting citizens’ rights and enabling trans-Atlantic commerce in all sectors of the economy, including for small and medium enterprises”. By advancing cross-border data flows, the new framework will “promote an inclusive digital economy in which all people can participate and in which companies of all sizes from all of our countries can thrive”.

The parties will now work together to translate this agreement in principle into legal documents that will need to be adopted by both sides. To read the Joint Statement in full and for a link to the Factsheet, click here.