Political pressure wins out as US secures preliminary EU data deal

In the final race to secure a new transatlantic data deal, Ursula von der Leyen and Joe Biden pulled rank.

On Friday, the European Commission president and U.S. president announced that Washington and Brussels had signed an agreement “in principle” for a new so-called Privacy Shield pact to keep everything from people’s online search queries to company payroll records flowing between the European Union and the United States.

But in the weeks and days building up to the announcement, U.S. and European negotiators — who have spent almost two years hammering out details to give EU citizens greater control over their data when it’s transferred to the U.S., while also allowing American national security agencies access to some of that information — had warned that final sticking points are yet to be hashed out.

Other officials cautioned that whatever senior political leaders wanted in terms of securing a new data transfer agreement would still likely be challenged in Europe’s highest court. With such legal uncertainty looming, it was critical to ensure any new agreement would be in water-tight compliance with the 27-country bloc’s tough data protection standards, they added.

Yet amid efforts to show renewed transatlantic unity following Russia’s invasion of Ukraine, both von der Leyen and Biden cast those doubts aside. They framed Friday’s announcement as a necessary balance between people’s right to privacy and legitimate national security concerns. Spurred on by heat from their political bosses, officials scrambled to get as much over the line as possible to make a political agreement feasible, with one EU official noting talks this week went well into the night.

“[We’re] pleased that we found an agreement in principle on a new framework for transatlantic data flows,” von der Leyen said at a joint press conference with Biden. “It will enable predictable and trustworthy data flows, balancing security, the right to privacy and data protection.”

A statement from Justice Commissioner Didier Reynders tempered expectations a little more — saying that both sides had “agreed on the principles for a new framework.” That hinted that work still needed to be done behind the scenes before a final deal is in hand.

The road to a deal

In truth, senior EU and U.S. officials’ co-opting of the years-long privacy negotiations had been almost a year in the making.

When the U.S. president first visited Europe last summer for his inaugural summit, American officials hoped to secure a similar political agreement on data transfers — only to see those plans dashed after European policymakers balked at rushing through a new pact.

Washington, again, rekindled those hopes ahead of the first meeting in September 2021 of the EU-U.S. Trade and Tech Council, a transatlantic semi-regular meeting of senior officials including U.S. Commerce Secretary Gina Raimondo and European Commission Executive Vice President Margrethe Vestager. But, again, those efforts failed to win over EU negotiators.

The reluctance of some Brussels-based officials to sign off on a transatlantic data pact — born out of their previous work on similar transatlantic data agreements being torn apart by Europe’s top court, in both 2015 and 2020 — finally forced the hand of the highest political leaders to step in.

Given the ongoing conflict in Eastern Europe, renewed efforts to build better transatlantic ties in the post-Donald Trump era and the long-standing mutual threat posed by China, von der Leyen and Biden laid down a marker showing that — at least when it came to privacy and data — the EU and U.S. were a united force.

That stance, however, will likely be tested — and quickly.

Despite the political agreement, the details about what a new Privacy Shield pact will include still need to be outlined. That includes what domestic changes Washington is willing to make to give Europeans greater access to U.S. courts if they want to challenge how American national security agencies have potentially mishandled their personal information.

Biden will also have to sign an executive order implementing those changes and establishing a legal framework before the EU can finish its assessment of the U.S.’s new regime. That work is likely to drag on for weeks, if not months.

See you in Luxembourg

Europe’s top judges, based in Luxembourg, have already twice ruled the U.S. did not offer EU citizens sufficient protections when their data was shipped across the Atlantic. It will now be down to Biden — most likely via a new administrative body created within the U.S. Department of Justice, to oversee surveillance on Europeans — to prove that any proposed solution will stand the test of time.

Such detail has yet to be published, with officials saying a draft agreement may come as soon as next month. That will fire the starting gun in a separate drawn-out process of ratification within the EU.

European data protection regulators will have to give their assessment on the decision — and aren’t likely to give the U.S. an easy ride. Though their opinion is not binding, it could well force Brussels and Washington officials back to the negotiating table. EU national capitals will also get a say, and could veto any deal if they see cause for concern. That outcome is unlikely, as governments typically prioritize economic and political links with Washington over data protection concerns.

A recent U.S. Supreme Court decision, which gives the federal government greater leeway to keep national security practices out of the courts, may, however, have complicated final discussions. That ruling could allow Washington to sidestep Europeans’ efforts to challenge how U.S. intelligence agencies access and use their data.

For now, though, von der Leyen and Biden wanted a political win — and were willing to override the complexities of European data protection rules to get it done.

With legal challenges almost certain, though, Friday’s agreement could soon turn into a short-lived victory if Europe’s highest court again throws out efforts to strengthen transatlantic ties.