New Unilateral American-E.U. Data Privacy Framework a Step in the Right Direction, Says Panel

WASHINGTON, October 17, 2022 – President Joe Biden’s executive order to implement a European Union-U.S. data privacy framework is a big step toward establishing a more comprehensive transnational privacy regime, said experts at an Atlantic Council web event Monday.

“It’s been a long time coming but I think we reached a really good outcome here,” said Alex Greenstein, director of Privacy Shield, an office at the Department of Commerce.

The executive order – based on a March announcement and signed earlier this month – protects the countries’ personal and corporate data by limiting the Unites States’s signals intelligence collection to what is “necessary to advance a validated intelligence priority” and “proportionate to the validated intelligence priority.”

The order enumerates the purposes for which such intelligence may be gathered – e.g., protecting against a foreign military, terrorist, or cybersecurity threat – and the purposes for which it may not – e.g., burdening the free expression of political opinions, suppressing “legitimate privacy interests,” or disadvantaging individuals based on race, gender, or religion.

To ensure compliance, the order directs the attorney general to establish a Data Protection Review Court, which, as a subsidiary of the executive branch, will be stocked with judges from outside the federal government and will review cases with some degree of independence.

“This is a very important step,” said Christopher Kuner, co-director of the Brussels Privacy Hub. “But really we’re a ways away from a complete accepted transatlantic data privacy framework,” he added.

The EU is now expected to commit to some form of reciprocity. “This is not an international agreement,” Alisa Vekeman, head of the transatlantic data flows team for the European Commission, said at the event Monday. “There has been a unilateral process on the U.S. side, now there will be a unilateral process on the E.U. side.”

Current U.S.–E.U. negotiations are largely driven by the E.U. Court of Justice’s decision to strike down a previous framework, the “Privacy Shield,” in 2020. According to the White House, the new framework will “restore trust and stability to transatlantic data flows and reflects the strength of the enduring EU-U.S. relationship based on our shared values.”