EU and US strike new privacy deal following demise of Safe Harbour

The EU and US have reached an agreement on a new scheme to allow companies to move personal data across the Atlantic following months of negotiations.

Officials agreed a framework for a new deal to replace “Safe Harbour”, the system that was ruled illegal by the European Court of Justice last year following a case brought by an Austrian law student.

America has made assurances that the new scheme – “Privacy Shield” – will safeguard Europeans’ data according to the European Commission.

The US has agreed not to undertake “indiscriminate mass surveillance on personal data”, and will be required to protect Europeans’ data.

Commission vice-president Andrus Ansip said: “We have agreed on a new strong framework on data flows with the US. Our people can be sure that their personal data is fully protected. Our businesses, especially the smallest ones, have the legal certainty they need to develop their activities across the Atlantic.

“We have a duty to check and we will closely monitor the new arrangement to make sure it keeps delivering. Today’s decision helps us build a Digital Single Market in the EU, a trusted and dynamic online environment; it further strengthens our close partnership with the US. We will work now to put it in place as soon as possible.”

Vera Jourova, the European justice commissioner, added: “For the first time ever, the United States has given the EU binding assurances that the access of public authorities for national security purposes will be subject to clear limitations, safeguards and oversight mechanisms.”

Marie McGinley, head of intellectual property, technology and data protection at Eversheds Ireland, said: “While it has been promised that the new EU-US Privacy Shield will provide for strong obligations on companies handling Europeans’ personal data, robust enforcement mechanisms, clear safeguards and transparency obligations on the U.S. government and effective protection of EU citizens’ rights with several redress possibilities, the ultimate test will be in the detail.

“The key for both the EU Commission and the US is to ensure that this new EU-US Privacy Shield is robust enough to fulfil the requirements of the CJEU.

“This announcement will undoubtedly raise a lot of questions about what to do about transfers in the interim. A lot of companies have invested heavily in adopting alternatives and so they will need some convincing about the workability and shelf life of the “EU-US Privacy Shield” to move to the new mechanism. As well as a better indication of when they might be able to evaluate and adopt it.”