On March 25, 2022, the White House and the European Commission announced their commitment to a new Trans-Atlantic Data Privacy Framework, to replace the EU-US Privacy Shield framework that was struck down by the European Court of Justice in July 2020. Through the new framework, the United States will address the concerns of the European Union by establishing a new mechanism and independent authority for the resolution of disputes, enhancing oversight of signals intelligence activities, and strengthening the civil liberties and privacy safeguards governing US signals intelligence activities.
Under the new framework, the US has committed to permitting the collection of signals intelligence only when supported by legitimate national security objectives, and to adopting procedures to ensure effective oversight of the stipulated standards. In addition, the framework establishes a Data Protection Review Court composed of adjudicators who are not in the employ of US government agencies.
Participating companies would still be required to comply with the principles of the Privacy Shield framework – in particular, self-certification through the established Department of Commerce channels. In addition to the new authority for dispute resolution, EU participants will continue to have access to other avenues of redress including alternative dispute resolution and binding arbitration.
The United States and the European Commission will draft legal documents to implement the principles enunciated in the joint statement, following the issuance of an Executive Order forming the basis of the new framework.