US President Joe Biden on Friday signed an executive order aimed at protecting privacy in the transfer of personal data between the EU and the United States and addressing European concerns over US intelligence gathering activities.
The executive order creates a new regulatory framework for transatlantic data flows, which are critical to the digital economy, the White House said.
It will be reviewed and ratified by the European Commission, a process expected to take several months.
“This is a culmination of our joint efforts to restore trust and stability to transatlantic traffic,” Trade Secretary Gina Raimondo told reporters.
“It will enable a continuous flow of data underpinning more than $1 trillion in cross-border trade and investment each year.”
US tech giants are facing a spate of lawsuits from EU privacy activists concerned about US intelligence agencies’ ability to access Europeans’ personal data.
Europe’s top court has overturned previous agreements after hearing complaints that US laws violate the fundamental rights of EU citizens.
The White House said the executive order addresses concerns raised by the Court of Justice of the European Union when it ruled that the previous framework known as the Privacy Shield did not provide adequate protection.
Privacy Shield, which was struck down in July 2020, was the successor to another EU-US agreement, Safe Harbor, which itself was torpedoed by a court ruling in 2015.
Businesses have since resorted to legally unsafe workarounds to keep data flowing in the hope that both sides could come up with something stronger in the long run.
US officials conceded that the new pact will almost certainly face intense legal scrutiny, which began after Edward Snowden’s revelations about mass digital espionage by US authorities.
– “Robust Commitments” –
Raimondo expressed confidence that the new agreement, which builds on an agreement in principle announced in March, will stand.
“The EU-US data protection framework includes robust privacy and civil liberties-enhancing commitments for signals intelligence that ensure the protection of EU personal data,” she said.
The executive order requires that U.S. signals intelligence activities be conducted “only in pursuit of defined national security objectives” and “respect the privacy and civil liberties of all individuals,” regardless of nationality or country of residence.
It creates an independent court for EU citizens “to seek redress if they believe they are unlawfully targeted by US intelligence activities”.
The redress process consists of two levels.
The first is a Civil Liberties Protection Officer (CLPO) in the US Office of the Director of National Intelligence who investigates complaints to determine whether they involve a violation of US law.
The second is an independent privacy review court that reviews the decisions of the CLPO.
“Judges of the DPRC are appointed from outside the US government … review cases independently and enjoy protection from deportation,” the White House said.
Your decisions are binding.
