EU Approves Data-Transfer Deal With U.S.

BRUSSELS—The European Union has approved a plan that will allow companies to keep storing data about Europeans on U.S. soil, averting a potentially costly disruption in trans-Atlantic data flows.

The deal announced Monday by the European Commission, the EU’s executive arm, marks the culmination of lengthy negotiations with the U.S. about data transfers that are used by thousands of companies to do things such as sell online ads and measure traffic to their websites.

The issue has been a concern for some of the world’s biggest tech companies, including Meta Platforms and Alphabet’s Google, which have faced legal challenges to data transfers that are central to their business in Europe.

However, the deal approved Monday—known as the Trans-Atlantic Data Privacy Framework—is expected to face a legal challenge from European privacy advocates, who have long said that the U.S. needs to make substantial changes to surveillance laws.

Transfers of data from Europe to the U.S. have been in question since an EU court ruled in 2020 that a previous deal allowing trans-Atlantic data flows was illegal because the U.S. didn’t give EU individuals an effective way to challenge surveillance of their data by the U.S. government.

EU privacy regulators earlier this year fined Meta 1.2 billion euros, equivalent to $1.3 billion, for storing information about European users on servers in the U.S. The company was also told to stop sending information to the U.S. about Facebook’s European users and to delete data it had already sent if it had no new legal way to keep it there by fall.

The deal announced Monday means Meta should be able to avoid the order to delete data and halt flows, although the company is still expected to be subject to the fine. Meta has said it would appeal the EU privacy ruling.

Meta said on Monday that it welcomed the data flow agreement, which it said would safeguard the goods and services relied on by people and businesses on both sides of the Atlantic.

The Computer & Communications Industry Association, which represents companies including Amazon and Google, said the deal would give companies full legal certainty in transferring personal data across the Atlantic.

The deal, which takes effect immediately, comes after Brussels and Washington reached a preliminary agreement on data privacy last year.

The agreement requires the U.S. to create a court that will have the authority to handle EU individuals’ claims and impose remedies if it finds that U.S. laws were violated. President Biden announced the creation of the court, which the U.S. called the Data Protection Review Court, in an executive order last year.

Complaints will first be reviewed by a civil-liberties-protection officer in the U.S. and may undergo a second layer of review at the data-protection court, according to the executive order.

The U.S. has also committed to limiting the collection of signals intelligence, which can intercept electronic communications, as part of the agreement with the EU.

Biden said the deal reflects a joint commitment to data privacy and will create greater economic opportunities in both the U.S. and Europe.

“Personal data can now flow freely and safely,” EU Justice Commissioner Didier Reynders

Two previous data agreements, known as Safe Harbor and Privacy Shield, were struck down by European courts. 

Max Schrems, an Austrian lawyer and privacy activist who led the legal challenges to the earlier agreements, said he plans to challenge the latest deal, too. “We would need changes in U.S. surveillance law to make this work and we simply don’t have it,” Schrems said.

The deal comes during a period of close cooperation between the U.S. and Europe. The two sides have worked closely on their response to the war in Ukraine, including sanctions against Russia, and have become more aligned in their views on economic ties with China compared with previous years.

Write to Kim Mackrael at [email protected]