Commissioner Věra Jourová briefed the College of Commissioners on Tuesday 2 February, at their regular meeting taking place in Strasbourg, that her negotiators reached a political agreement on a new EU-US data transfer framework, the so-called Safe Harbor. The agreement, which will have to be formally adopted through a formal exchange of letters, comes at the last possible moment. European data protection authorities (DPAs) meet on 2-3 February to decide, among others, about the fate of privacy complaints against US firms. Since the previous data transfer framework was cancelled by EU court last year, they should pursue full-scale investigations – which would not add to certainty mainly in the digital industry. It is now expected, that DPAs will extend their grace period to the EC until the new Safe Harbor is officially in place.

At a speech to the EP´s LIBE committee on 1 February, Commissioner Jourová presented the main elements a new Safe Harbor would need to include. It would need to 1) contain limitations and safeguards concerning access to data by public authorities (national intelligence), 2) contain provisions on independent oversight and individual redress, 3) contain provisions concerning resolution of individual complaints and 4) be legally binding on the US side.

On the first point, the US would state in a written commitment, that EU citizens´ data would not be indiscriminately screened and any access by security services would be strictly proportionate. The EU would review the application of these principles annually. On the second, Ms Jourová stated that the State Department would create an office of ombudsman whose task would be to investigate data privacy complaints on the US side. Thirdly, EU citizens would be able to complain against misuse of their data in the US at their national DPA. This, in turn, would resolve the issue jointly with the Federal Trade Commission. And lastly, Ms Jourová expects the deal to be signed by the highest possible ranking officials on both sides of the Atlantic – and thus to have the highest possible political backing. It should be added that the Safe Harbor “agreement” is not an international agreement per se. Formally, it will be a decision by the EC stating that EU citizens´ data is well protected in the US – and that therefore the data can flow freely, once the company involved declares adherence to its principles. The EC will issue the decision following an exchange of letters clarifying the level of data protection in the US.

Although the last minute deal is undoubtedly good news not only for digital industry, critics point out that it still contains many weak points that the EU court could eventually use to cancel it anytime in the future.

For more, click here, here, here and here. Details in Czech are available here.

Read also the article The new EU-US privacy shield: what does it mean for data sharing?