The European Union on Monday gave final approval to an agreement with the US government that restores the ability for thousands of businesses to easily transfer the personal information of European citizens to servers located in the United States, and vice versa, in the face of surveillance concerns by privacy advocates.
The decision resolves, for now, years of uncertainty about the future of transatlantic data flows that US officials say support more than $1 trillion in annual economic activity. Those data flows had been threatened when a previous EU-US agreement was struck down in 2020 by Europe's top court over insufficient privacy protections for EU citizens.
With the EU's approval, the new agreement again allows businesses to transfer European data to the United States as if it were another EU member state, without requirements to implement additional privacy safeguards.
Monday's so-called "adequacy decision" by the European Commission paves the way for companies to sign up for the EU-US Data Privacy Framework, which entered into force the same day.
EU officials said the new framework improves upon its predecessor by tying in an executive order signed by President Joe Biden last year limiting how US intelligence agencies may access European citizens' personal information.
The order also provided for the creation of a new court-like body that can force US companies to delete EU citizens' data if an investigation determines that EU citizens' privacy rights were violated. EU citizens will be able to file individual complaints to the Data Protection Review Court.
In a statement, EU President Ursula von der Leyen called the US enhancements "unprecedented."
"Today we take an important step to provide trust to citizens that their data is safe, to deepen our economic ties between the EU and the US, and at the same time to reaffirm our shared values," von der Leyen said. "It shows that by working together, we can address the most complex issues."
But civil liberties advocates on Monday sharply criticized the framework as too similar to "Privacy Shield," the agreement struck down in 2020, signaling that the new framework is likely to be tested with its own court challenges.
"Guess what: it is largely a copy of the old principles!" tweeted Max Schrems, the privacy activist who led the charge that resulted in Privacy Shield's nullification.
