New Privacy Shield Agreement Announced

The previous agreement for trans-Atlantic data flows, called “Privacy Shield” was struck down by the Court of Justice of the EU (CJEU) in 2020. The new agreement will preserve some aspects of the old Privacy Shield, such as the requirement to self-certify with the U.S. Department of Commerce. The “New” Privacy Shield will require the U.S. to implement new safeguards to ensure the surveillance practices of U.S. intelligence are “necessary and proportionate,” and will feature a new mechanism for Europeans to seek redress if they are unlawfully targeted by those practices, addressing key reasons for the invalidation of the old Privacy Shield. The final version of the agreement will be subject to the usual approval processes by the U.S. and the EU, including an opinion of the European Data Protection Board (EDPB) on the European Commission’s proposal.