The US Executive Order published today, which lays the ground for the new EU-US data transfer agreement, is likely still insufficient to protect Europeans’ privacy and personal data when it crosses the Atlantic. The data in question ranges from consumers’ photos to their emails or phone numbers.

Most measures proposed in the new Order are aimed at addressing the European court’s concerns regarding US government surveillance. However, there are no substantial improvements to address issues related to the commercial use of personal data, an area where the previous agreement, the EU-US Privacy Shield, fell short of GDPR requirements.

There are still fundamental differences in the level of privacy and data protection in the US and the EU which remain too large to make up for, despite the additional safeguards the US side is proposing to build in.

Ursula Pachl, Deputy Director General of the European Consumer Organisation (BEUC), said:
“However much the US authorities try to paper over the cracks of the original Privacy Shield, the reality is that the EU and US still have a different approach to data protection which cannot be cancelled out by an executive order. The moment EU citizens’ data travels across the Atlantic, it will not be afforded similar protections as in the EU.

“While a proposal to create much needed US federal privacy and data protection legislation is currently under discussion, the future of this proposal is uncertain. The US still has no federal data protection law providing equivalent protection to the GDPR. A satisfactory data flows agreement requires legislative reform in the US.

“The US and the EU Commission should keep working to improve the situation and not concede to political or corporate pressure. BEUC urges EU data protection authorities to scrutinise any new data transfer agreement with rigour. Nobody wants more legal uncertainty. We need a long-lasting solution to make sure consumers can trust that their data is safe wherever it goes.”

Background
In 2015 and 2020, following action from civil society which includes Max Schrems, the European highest court (the CJEU) struck down European Commission decisions which had respectively declared the Safe Harbour Decision and the EU-US Privacy Shield agreement adequate for the transfer of EU citizens’ data to the US. The European court ruled this on the basis the Commission decisions did not sufficiently protect Europeans’ fundamental rights.