Biden signs order to implement EU-US data privacy framework

US President Joe Biden on Friday signed an executive order to implement a European Union-United States data transfer framework announced in March that adopts new American intelligence gathering privacy safeguards.

The deal seeks to end the limbo in which thousands of companies found themselves after Europe's top court threw out two previous pacts due to concerns about US surveillance.

US Commerce Secretary Gina Raimondo told reporters the executive order "is the culmination of our joint effort to restore trust and stability to transatlantic data flows" and "will ensure the privacy of EU personal data."

The framework addresses the concerns of the Court of Justice of the European Union (CJEU), which in July 2020 struck down the prior EU-US Privacy Shield framework as a valid data transfer mechanism under EU law.

European Commissioner for Justice Didier Reynders said he was "quite sure" there would be a fresh legal challenge, but he was confident that the pact met the demands of the court.

"We have a real improvement relative to the Privacy Shield.... It's totally different," he told Reuters in an interview. "Maybe the third attempt will be the good one."

The White House said "transatlantic data flows are critical to enabling the $7.1 trillion EU-US economic relationship" and the framework "will restore an important legal basis for transatlantic data flows."

The US Chamber of Commerce and Microsoft welcomed the executive order, but digital rights activist group Access Now and European consumer organization BEUC said it did not appear that people's rights were being sufficiently protected.

The White House said Biden's order bolstered current "privacy and civil liberties safeguards" for US intelligence gathering and created an independent, binding multi-layer redress mechanism for individuals who believe their personal data was illegally collected by US intelligence agencies.

Reynders said it would take about six months to complete a complex approval process, noting the previous system only had redress to an ombudsperson inside the US administration, which the EU court rejected.

Biden's order adopts new safeguards on the activities of US intelligence gathering, requiring they do only what is necessary and proportionate, and creates a two-step system of redress - first to an intelligence agency watchdog then to a court with independent judges, whose decisions would bind the agencies.

Biden and European Commission President Ursula von der Leyen in March said the provisional agreement offered stronger legal protections and addressed the EU court's concerns.

Raimondo on Friday will transmit a series of letters to the EU from US agencies "outlining the operation and enforcement of the EU-US data privacy framework" that "will form the basis for the European Commission's assessment in a new adequacy decision," she said.

Under the order, the Civil Liberties Protection Officer (CLPO) in the US Office of the Director of National Intelligence will investigate complaints and make decisions.

The US Justice Department is establishing a Data Protection Review Court to independently review CLPO's decisions. Judges with experience in data privacy and national security will be appointed from outside the US government.

European privacy activists have threatened to challenge the framework if they did not think it adequately protects privacy. Austrian Max Schrems, whose legal challenges have brought down the previous two EU-US data flow systems, said he still needed to analyze the package.

"At first sight it seems that the core issues were not solved and it will be back to the CJEU (EU court) sooner or later," he said.