On July 10, 2023, the European Commission made a highly significant decision regarding data transfer between the European Union (EU) and the United States (US), characterizing this data flow as "safe and reliable." This decision immediately raised questions about its connection to the previous Privacy Shield agreement and the nature of a possible new agreement.

I. The New Legal Framework:

The Privacy Shield, established in 2016, aimed to ensure that American companies adhered to data protection standards equivalent to those of the EU in response to the invalidation of its predecessor, the Safe Harbor, by the Court of Justice of the European Union (CJEU) in 2015. This framework imposed strict principles on American companies, including transparency in data collection and use, the establishment of redress mechanisms for European citizens, and oversight by the US Department of Commerce.

However, it quickly became the subject of major controversies due to concerns related to surveillance by US intelligence agencies, particularly under Section 702 of the Foreign Intelligence Surveillance Act (FISA), which allows large-scale surveillance of individuals outside the United States. In July 2020, the CJEU invalidated the Privacy Shield, arguing that it did not ensure adequate protection of the personal data of European citizens due to excessive surveillance.

This invalidation created a legal vacuum and prompted stakeholders to seek a new legal framework for data transfers.

II. Implications and Reactions:

The new legal framework is of crucial importance to tech giants such as Google, Meta (formerly Facebook), and Amazon. It provides enhanced safeguards to limit access by US intelligence agencies to data collected in Europe and allows European citizens to challenge the unlawful collection of their personal data by US authorities.

Alexandre Roure, Director of Public Policy at CCIA, welcomed this development, stating that it will create a stable legal environment for personal data transfers and stimulate economic growth.

Despite controversies, EU and US policymakers are praising this new framework as a testament to their shared commitment to robust personal data protection.

However, this framework also sparks debates and concerns regarding personal data protection, even though it represents a significant step toward a more stable solution for businesses and citizens on both sides of the Atlantic, filling the void left by the invalidation of the Privacy Shield.