President Joe Biden unveiled an Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities to create the legal instruments necessary to effectuate the previously announced Trans-Atlantic Data Privacy Framework with the European Commission. The framework essentially paves the path toward reinstating the transatlantic data sharing mechanism previously known as Privacy Shield, and this Executive Order marks the completion of first formal legal step required to complete that journey. The European Commission will now evaluate the new redress and oversight mechanisms put into place through the Executive Order and accompanying Attorney General regulations and contemplate whether the United States qualifies for an adequacy determination that would mark the resumption of transatlantic data transfers through the next iteration of Privacy Shield.
As we’ve written before, Privacy Shield was a vital mechanism for small businesses to legally transfer personal information from the European Union to the United States before the Court of Justice of the European Union’s (CJEU) struck it down with its ruling in the Schrems II case. The court’s decision deemed that the United States and European Union did not have functionally equivalent legal protections for citizens due to insufficient redress mechanisms available to European individuals when they felt they had been unlawfully targeted by U.S. surveillance activities.
The Executive Order seeks to remedy the shortfalls documented in the CJEU’s decision by creating a multi-layered redress mechanism, including a new independent appeals authority known as the Data Protection Review Court. The Executive Order also creates new oversight of U.S. signals intelligence activities by requiring that such activities be conducted only in pursuit of defined national security objectives, be conducted only when necessary to advance a validated intelligence priority, and be conducted in a manner “proportionate” to that priority.
We applaud both the Administration and the European Commission for their tireless negotiations in the leadup to this Executive Order. Going forward, we urge the European Commission to begin its consideration of an adequacy determination as expeditiously as possible in order to restore transatlantic data flows and ease the burden on our small business members seeking to compete in the global economy. For more, please see our statement on the announcement of the Executive Order here and our letter to President Biden on the announcement of the Transatlantic Data Privacy Framework here.