Big Victory for Meta and Google: Data Pact Between EU and US Approved

The European Commission has decided that it is safe for personal data to be transferred from the European Union to American big tech companies such as Facebook and Google, despite many advocates protesting against this decision due to concerns over U.S. government surveillance.

The Commission announced that it has ‘adopted a decision on the adequacy of the EU-U.S. data privacy framework‘, concluding that ‘the United States provides an adequate level of protection—comparable to that in the European Union, for personal data transferred from the EU to U.S. companies under the new framework. Based on the new adequacy decision, personal data can flow safely from the EU to U.S. companies participating in the Framework, without the need for additional data protection measures.’

In May of this year, Facebook’s owner, Meta, was fined €1.2 billion for violating the General Data Protection Regulation (GDPR) by transferring personal data to the United States and was ordered to stop storing data of users from the European Union in the U.S. within six months. At that time, Meta threatened to withdraw its business from the EU and that users from the Union would not have access to Meta’s applications such as Facebook, but that, of course, did not happen.

Legal Challenges

The data transfer agreement is expected to ‘face a legal challenge from European privacy advocates, who have long argued that the U.S. needs to make significant changes to its surveillance laws.’ Data transfers from Europe to the U.S. were called into question when the EU court ruled in 2020 that the previous agreement, which allowed transatlantic data flows, was illegal because the U.S. did not provide EU individuals with an effective way to challenge surveillance over their data.

In a statement, the EC noted that the new framework includes ‘binding safeguards to address all concerns raised by the European Court of Justice, including limiting U.S. intelligence agencies’ access to EU data to what is necessary and proportionate, and establishing a Data Protection Review Court (DPRC), which EU individuals will have access to.’ The new court will ‘be able to order the deletion’ of data found to have been collected in violation of the new rules.

EU residents who contest data collection will have free access to ‘independent dispute resolution mechanisms and an arbitration panel.’

The U.S. and the EC agreed on a data privacy framework in March 2022, and the U.S. announced last week that it has fulfilled its obligations to implement the agreement. Google supported the agreement and also stated that the agreement provides a ‘reliable and lasting foundation for the future of online services on both sides of the Atlantic.’

American companies can join the EU-U.S. framework if they commit to adhering to the set of obligations agreed upon in this agreement.

Previous data agreements known as Safe Harbor and Privacy Shield were invalidated by European courts. Max Schrems, an Austrian lawyer and privacy activist who led legal challenges against earlier agreements, stated that he plans to contest the latest agreement as well.

‘We need changes in U.S. surveillance law for this to work, and we simply do not have them,’ Schrems said.

Member of the European Parliament Birgit Sippel, from the German Social Democratic Party, stated that ‘the framework does not provide any significant protection against the indiscriminate surveillance conducted by U.S. intelligence agencies.’

The approval of the agreement by the EC was praised by the Computer and Communications Industry Association, which represents Amazon, Apple, eBay, Google, Meta, Twitter, and other tech companies.

‘Today’s decision means that businesses from the EU and the U.S. will soon have full legal certainty for the transfer of personal data across the Atlantic… Data flows are crucial for transatlantic trade and the economic relationship between the EU and the U.S., which is worth €5.5 trillion annually. Nevertheless, the two economies have been left without guidance for data transfers after the EU court ruling invalidated the previous framework back in 2020,’ the group stated.