Biden Administration Implements Data Protection Framework for US-EU Data Sharing

Learn how your business can build apps to automate tasks and gain efficiencies with low-code/no-code tools on November 9 at the Virtual Low-Code/No-Code Summit. Register here.

Cross-border data transfers may be necessary to generate insights, but they are often a data protection nightmare.

Since the Court of Justice of the European Union (CJEU) annulled the EU-US agreement. Safe Harbor and Privacy Shield Agreement in its Schrems II 2020 decision due to concerns that US nation-state surveillance has violated GDPR, there is no legal framework for the transfer of personal data of EU citizens to the United States

However, this is no longer the case. Today, President Biden signed an executive order committing the United States and the European Commission to form a new Transatlantic Data Privacy Framework, which establishes a legal mechanism that organizations can use to lawfully transfer citizens' personal data from the EU to the United States. new cross-border guidelines come as the U.S. Department of Commerce also just released tough rules for U.S. companies to cut off microchip supplies from China.

According to a statement released by the White House, the Executive Order Clarifying Cross-Border Guidelines gives data subjects the opportunity to seek redress if they believe their personal data has been collected by signals intelligence "in a manner that violates the applicable U.S. law". ."

Event

Low-Code/No-Code vertex

Join today's top leaders at the Low-Code/No-Code Summit virtually on November 9. Sign up for your free pass today.

register here Removing uncertainty about cross-border data protection standards

The executive order comes after a wave of uncertainty surrounding cross-border data protection standards in the wake of the Shrems II decision, which, as noted above, invalidated the safe harbor agreement between the EU and US as well as the Privacy Shield, and reduced support for transfer of personal data from the EU to the US

The court noted in its judgment that the data protection practices of US government surveillance programs “cannot be considered to be limited to what is strictly necessary” and fundamentally fail to respect the privacy of those affected. of the EU.

Following this decision, many organizations have begun to review their policies regarding the processing and transfer of EU citizens' data. This process was largely guesswork, due to a lack of centralized guidance, which led to serious enforcement action against non-compliant organizations.

For example, on January 13, 2022, the Austrian data protection authority ruled that Google Analytics breached GDPR, alleging that the organization transmitted data to the United States while failing to protect it from privacy. US government oversight. This was not in accordance with the decision of Schrem's II...