The White House has hammered out a new agreement with the EU that could again allow businesses to transfer data and personal information across the Atlantic, a highly-anticipated move that could provide assurance to thousands of companies after Europe’s top court struck down the deal’s predecessor in 2020.
In joint remarks with European Commission President Ursula von der Leyen, US President Joe Biden said Friday that the new partnership will “once again authorize transatlantic data flows that help facilitate $7.1 trillion in economic relationships with the EU.”
“This will enable predictable and trustworthy data flows between the EU and U.S., safeguarding privacy and civil liberties,” von der Leyen said.
The announcement signals the possible end of nearly two years of uncertainty after the European Court of Justice invalidated Privacy Shield, an earlier version of the agreement.
The US-EU agreement seeks to ensure that the personal information of EU citizens can be moved to US data centers while maintaining EU-level privacy protections.
Thousands of businesses — and not just tech companies — rely on the smooth flow of data across the Atlantic every day. According to a 2020 congressional letter to the Commerce Department and the Federal Trade Commission, US-EU data flows “are the highest in the world.”
“Transatlantic data flows enable people and companies to transmit information for online communication, track global supply chains, share research, provide cross-border services, and support technological innovation, among other activities,” the Congressional Research Service wrote in a report last year.
The 2020 ruling by the European Court of Justice, over concerns that US surveillance laws inadequately protected EU citizens’ rights, threatened to disrupt those data flows. In the wake of that decision, many companies faced difficult choices: Their options were limited to either pulling out of European markets, storing and working with EU data only within the EU, or shifting increasingly to standardized contractual language on data sharing pre-approved by the EU.
While Facebook and other tech giants increasingly opted for the latter, those so-called standard contractual clauses have been described by some experts as unsustainable at scale and potentially more costly for businesses to maintain.
“In general, the costs associated with using SCCs are higher than those associated with participating in Privacy Shield,” the Congressional Research Service report said.
The new, overarching data transfer agreement could avoid those headaches altogether. Under the tentative deal, which must still be finalized, US surveillance authorities will only access EU citizens’ data “to advance legitimate national security objectives” and will not “disproportionately impact … individual privacy and civil liberties,” according to a White House fact sheet. EU citizens will also gain new ways to seek redress if they believe they have been illegally surveilled.
The Biden administration will codify its commitments in a forthcoming executive order, the fact sheet said.
Biden and von der Leyen also announced commitments to cooperate on cybersecurity and cryptocurrency, two issues that have immediate implications for the war in Ukraine and more broadly.
In a joint statement, the two leaders vowed to “coordinate cybersecurity assistance and provide Internet access” to Ukraine, while also cooperating to share cyber threat information and double down on disrupting ransomware gangs.
They also announced a “transatlantic sprint” to share “financial intelligence” on the illicit use of cryptocurrency, part of a wider effort that includes steps to prevent Russia from using cryptocurrency to evade international sanctions.
“Together, we intend to deepen our shared commitment to advance anti-money laundering and countering financing of terrorism… for digital assets, consistent with the Financial Action Task Force (FATF) standards,” the statement read.
