EU-US Privacy Shield ‘safe harbour’ comes with assurances against US mass surveillance and the protection of EU citizens’ data

Europe and the US have reached a new “robust” deal over data sharing that will ensure the safety of EU citizens’ data when transferred across the Atlantic by firms such as Facebook, Apple and Google.

The new EU-US privacy shield will allow companies to transfer and process EU citizens’ data in the US given certain privacy guarantees. It comes after the original data-sharing safe harbour agreement from 2000 used by 4,500 companies was struck down in October by the European court of justice, following legal action by an Austrian privacy campaigner following the Snowden revelations of mass US government surveillance.

Andrus Ansip, European commissioner for the digital single market said: “We have agreed with our US partners a new framework that will ensure the right checks and balances for our citizens.”

Vera Jourova, European commissioner for justice, said: “For the first time ever, the US has given the EU binding assurances that the access of public authorities for national security purposes will be subject to clear limitations, safeguards and oversight mechanisms.”

He said the deal struck two days late between Brussels and Washington is greatly improved over the original 2000 agreement, offering “robust and significant improvements” as well as “detailed assurances” on safeguards and limitations of US surveillance programs for the first time.

Part of the EU-US privacy shield will involve an annual joint review of the data-sharing agreement and a new US official responsible for following up EU data protection complaints.

The new pact will effectively allow the easy transfer of data from the EU to the US, with promises of privacy protections equivalent to those afforded to the data of EU citizens while in the EU. The invalidation of the original 2000 deal spurred fears over privacy challenges from EU citizens worried about their data privacy, which would have landed with the individual data protection authorities in each of the 28 member states and could potentially have proved expensive for US technology companies like Microsoft, Facebook and Google.

Companies who employ the new agreement will face regular compliance checks from the US Department of Commerce to ensure that they are still following the deal’s rules, which are supposed to ensure that companies based in US apply data protection standards akin to those found in the EU.

The news was welcomed with reservation by many, keen to see that businesses wishing to operate in the EU have a clear and cost effective way of transferring data without requiring potentially hundreds of individual contracts with data controllers and processors.

Antony Walker, deputy chief executive of techUK, which represents over 900 companies from the UK technology industry, said: “The fact that EU and US negotiators have worked day and night for several months to secure this agreement reflects how important transatlantic data flows are to the global digital economy.”

Mike Weston, chief executive of data science consultancy Profusion, said: “A new safe harbour-style agreement is very welcome, however, I doubt it will be anything more than a stop-gap measure. It is also unlikely to quell disquiet in the tech community by restoring long term confidence in the transatlantic flow of data.”

Phil Lee, data protection partner at European law firm Fieldfisher, said: “Keeping in mind that this new safe harbour will almost certainly be challenged by civil liberties groups (and possibly even some data protection authorities) pretty much immediately, only the foolhardy would place want to place their trust in a new safe harbour right now.”

Jourova said she’s confident that the new arrangements that used the October court ruling to help “in the formulation of the new structure” will be capable of withstanding further challenge.

Ansip said: “Our people can be sure that their personal data is fully protected. Our businesses, especially the smallest ones, have the legal certainty they need to develop their activities across the Atlantic.”