On March 25, 2022, U.S. President Joe Biden and European Commission President Ursula von der Leyen announced that the U.S. and the EU have reached a political agreement in principle on a new Trans-Atlantic Data Privacy Framework for cross-border transfers of personal data (the “Framework.”)

The agreement in principle foresees that with the Framework, personal data will be able to flow freely and safely from the EU to participating U.S. companies. A new set of rules and binding safeguards will limit access to personal data by U.S. intelligence authorities to that which is necessary and proportionate to protect national security, and U.S. intelligence agencies will adopt procedures to ensure effective oversight of new privacy and civil liberties standards. Also, under the Framework, a new two-tier redress system will be established to investigate and resolve complaints brought by residents of the EU about access to personal data by U.S. Intelligence authorities, which includes a Data Protection Review Court. The Framework includes strong obligations for companies transferring personal data from the EU to the U.S. and will retain the requirement to self-certify adherence to the Privacy Shield-like principles through the U.S. Department of Commerce. Lastly, the Framework foresees specific monitoring and review mechanisms.

The EU and the U.S. expect the deal to provide adequate protection for personal data relating to EU residents transferred to the U.S., addressing the ruling of the European Court of Justice (CJEU) (judgment of July 16, 2020, C-311/18, or “Schrems II”), safe and secure personal data flows, and a durable and reliable legal basis for personal data flows between the EU and the U.S.

The next step is for the Framework to be converted into a legal framework, which is eagerly awaited not only by companies engaging in Transatlantic business, but also by various data protection organizations. NOYB European Center for Digital Rights and Max Schrems already announced their intention to analyze the final text in depth and, if it is not in line with EU law, to again bring a challenge to the EU – U.S. agreement before the CJEU. While the Framework is a big step towards final legal certainty, that still seems a long way off.