US, EU agree new pact on data transfers, but lawsuits loom

Brussels: President Joe Biden on Friday said the US and EU had reached a new agreement on the transfer of personal data that would replace previous arrangements that were struck down by Europe’s top court over spying concerns.

The urgently needed arrangements came as US tech giants faced a barrage of lawsuits from EU activists who are concerned about the ability of US security services to access the personal data of Europeans.

This will be a third attempt for a new data arrangement and succeeds deals that were invalidated after successful lawsuits argued that US laws violated the fundamental rights of EU citizens.

The deal "underscores our shared commitment to privacy, to data protection and to the rule of law", Biden said in a joint press appearance in Brussels with EU commission president Ursula von der Leyen.

He said the new deal, which was agreed in principle, would allow the EU executive "to once again authorise" the vast data flows and shore up the economic relationship with the EU. Von der Leyen hailed "another step in strengthening our partnership" that will enable "predictable and trustworthy data flows".

The pact for now puts to rest an issue that had become a nagging impediment to deeper transatlantic cooperation on trade and tech regulation and threatened to seriously disrupt business.

Big Tech companies said the deal "will restore legal certainty for businesses and stronger safeguards for users," a statement from the Computer & Communications Industry Association said.

The Software Alliance, a lobby for major data cloud companies, urged both sides to "to swiftly conclude negotiations". The new pact, which still needs to be finalised, will almost certainly face intense legal scrutiny that began after revelations by Edward Snowden of mass digital spying by US agencies.

Max Schrems, an Austrian activist and lawyer, has spearheaded the legal onslaught and on Friday dismissed the "political announcement" by Biden and Von der Leyen that would likely fail in court. Once the text lands, "if it is not in line with EU law, we or another group will likely challenge it," Schrems warned.

The previous deal, known as Privacy Shield, was struck down in 2020 and was the successor to another EU-US deal, Safe Harbour, which was itself torpedoed by a similar court ruling in 2015.

Businesses have since resorted to legally uncertain workarounds to keep the data flow moving, with hope that the two sides could come up with something stronger in the long term. Schrems has attacked these short-term solutions and his Austrian data privacy group NYOB (none of your business) has filed dozens of complaints against Google across Europe.