The European Commission and the United States have reached agreement on privacy rules that will regulate the flow of personal data between the two sides of the Atlantic. The EU executive announced it yesterday, underlining that the agreement "will protect the fundamental rights of Europeans when their data is transferred to the United States and will ensure legal certainty for the business".
In a note, the Commission explains that the agreement on the "privacy shield" reflects the requirements indicated by the EU Court of Justice in the October ruling which had declared the old Safe Harbor illegal.
The agreement includes stringent obligations for companies that handle personal data. American companies that want to import them into the US will have to undertake to respect a series of constraints on the way in which the data will be treated and on the guarantee of individual rights. The US Commerce Department will supervise the publication of commitments to this effect.
For the first time, the United States has given written assurances that the access of American public authorities for the observance of the law and national security will be subject to clear limits and safeguard mechanisms and external control. Such exceptions will only be used "when necessary" and will be "proportionate".
The US has ruled out indiscriminate mass surveillance of personal data. To regularly check the functioning of the agreement there will be an annual joint review which will also include the issue of national security access.
Businesses will have a maximum time within which to respond to appeals from EU citizens who believe they have been damaged: the EU can send appeals to the US Department of Commerce and the Federal Trade Commission. The dispute resolution mechanism will be free of charge and there will be access to national intelligence authorities for appeals. A new ombudsman will also be created.
