The European Union and the U.S. reached an agreement in its years-long discussion about international privacy laws on Monday, marking a major milestone for the two nations. The agreement, called the E.U.-U.S. Data Privacy Framework, opens the doorway for Europeans to file an appeal if they believe American intelligence agencies collected their personal information without their consent.
An independent review body called the Data Protection Review Court, will hear and rule on all appeals following the agreement to protect European data from being accessed by local public authorities, especially in the case of criminal law enforcement and national security.
According to the European Commission, complaints need to provide evidence that their data had been illegally obtained by U.S. intelligence agencies, and once a complaint is filed, it will be sent to the U.S. and investigated by a Civil Liberties Protection Officer.
The Privacy Framework replaces the former Privacy Shield agreement, which was dismissed by the EU’s top court in 2020 and the Safe Harbor deal enacted in 2000. At the time, the EU argued that the Privacy Shield didn’t provide enough protection for Europeans, but Max Schrems, a privacy activist who filed a lawsuit against the two former agreements, doesn’t think the Privacy Framework agreement does enough.
“We would need changes in U.S. surveillance law to make this work — and we simply don’t have it,” Schrems told Politico. “There are even parts that are worse than before so for example, purposes for mass surveillance now [include] climate change and international health crisis.”
While the official agreement was only enacted this week, President Joe Biden signed an executive order in October 2022, restricting U.S. intelligence agencies, including the National Security Agency, from obtaining access to European citizens’ data. In response to the agreed-upon Privacy Framework, Biden said he welcomes the “adequacy decision” in a statement adding that the decision “affirms the strength of our transatlantic relationship founded on our shared democratic values and vision for the world.
The agreement comes as companies have grown within the EU and as the U.S. government threatened it would be forced to shut down social media services like Facebook and Instagram in Europe if they did not find common ground before mid-October.
Meta’s president for global affairs, Nick Clegg, told Politico, “We welcome the new Data Privacy Framework, which will safeguard the goods [and] services relied on by people and businesses on both sides of the Atlantic.”
There is no time limitation on the E.U.-U.S. Data Privacy Framework agreement but the European Commission says it will continue to monitor any developments and regularly review the decision. At the one-year mark, the Commission will review the protocols in place and confirm whether the framework is functioning as intended, and will then consult with the EU Member States and data protection authorities to determine the timeline for future reviews. However, regardless of the decision, the Commission said in a press release that reviews “will take place at least every four years.”