EU says that US needs to comply with European data protection authorities

EU asks US firms to enforce privacy standards for new data pact to work

Europe sought to plug a gap in a new transatlantic data pact on Monday by urging US firms to allow European Union privacy regulators to police compliance with the new rules.

Brussels and Washington clinched a deal earlier this month on a new data transfer framework aimed at helping firms from both blocs seamlessly shuffle data between continents.

They said the deal, which was two years in the making and replaces a previous agreement struck down for failing to adequately protect Europeans’ data, underpins $260bn in digital services trade across the Atlantic.

Companies shuffle data from Europe to the United States to complete routine activities such as credit card transactions and hotel bookings. Data transfers also underpin the business models of technology companies such as Google and Facebook which collect users’ data to deliver targeted ads.

While companies transferring human resources data will be forced to comply with European Union privacy watchdogs’ decisions in disputes, for other companies it is voluntary.

However, the new “Privacy Shield” will be subject to an annual review to ensure companies moving data to the United States are abiding by EU data protection standards and the US government is not conducting mass indiscriminate surveillance.

The previous framework, Safe Harbour, was quashed by a top EU court last year after revelations about US government surveillance caused a political backlash in Europe.

To help substantiate that US government access to data is usually targeted and avoid a suspension by the EU of the new framework, the European Commission urged US companies to release aggregate figures of government access requests and submit to oversight by EU data protection authorities.

“Transparency reports … will contribute to maintaining confidence that such access is limited to what is necessary and proportionate,” it said as details of Privacy Shield were published and sent to member states for approval.

The main enforcers of the framework will be the US Department of Commerce and the US Federal Trade Commission after Washington resisted EU pressure for a greater role for European data protection authorities in enforcing the pact, which has been criticized by privacy advocates.