EU-US data-sharing deal comes into force amid threats of legal challenge

Receive free Technology regulation updates

We’ll send you a myFT Daily Digest email rounding up the latest Technology regulation news every morning.

The EU said a new transatlantic data-sharing agreement will come into force on Monday, in a move designed to reassure thousands of companies over the transfer of personal information between Europe and the US, even as the measures face legal challenges.

The European Commission said that a recent executive order issued by US president Joe Biden that imposed new obligations on the transfer of data between the regions provided adequate privacy protections to European citizens.

Commission officials said its decision meant global companies could move data safely according to the new regime, which included requirements on the responsible handling and deletion of personal information.

The European Court of Justice struck down the previous EU-US data-sharing deal, known as the privacy shield, in 2020, saying the agreement did not limit access to data by US authorities in ways that were “equivalent” to EU laws such as Europe’s General Data Protection Regulation (GDPR). The same court had previously annulled a similar data transfer arrangement, known as safe harbour, in 2000.

The US has sought to resurrect transatlantic data-sharing arrangements, as thousands of organisations, including tech companies, banks, law firms and carmakers, have relied on the privacy shield to move data easily between the two regions.

Biden’s executive order included new privacy guarantees, including the requirement to delete personal data when it was no longer needed, protections when such information was shared with third parties, and the possibility for EU citizens to seek damages if their personal data was mishandled.

Officials said the EU carried out its own assessment and unilaterally decided that the latest US concessions were legally sound and provided enough safeguards.

Didier Reynders, the EU’s commissioner for justice, said: “I have worked tirelessly with my US counterparts to address the concerns identified by the Court of Justice, and ensure that technological advances do not come at the cost of Europeans’ trust. But as close like-minded-partners, the EU and the US could find solutions, based on their shared values, that are both lawful and workable in their respective systems.”

Activists have said the agreement is flawed, with privacy campaigner Max Schrems, who previously challenged data-sharing agreements between the US and the EU, among those to threaten legal action against the new framework.

“They say the definition of insanity is doing the same thing over and over again and expecting a different result,” said Schrems. “Just like privacy shield, the latest deal is not based on material changes but by political interests.”

The implementation of the new EU-US transfer regime will be subject to periodic reviews to ensure it is effective. The first review is set to take place within one year of the adequacy decision’s entry into force.