Europeans’ Mistrust of U.S. Data Handling Bodes Ill for New Trans-Atlantic Data Privacy Framework

Is the third time the charm for a trans-Atlantic data privacy framework?

The United States and the European Union have the world’s largest digital trading relationship, underpinning their overall$7.1 trillioneconomic exchange. A large share of corporate data transfers between the two economies have nevertheless been in legal limbo since the Court of Justice of the European Union’s July 2020decision, known as Schrems II,invalidatedthe framework that allowed the two trading blocs to bridge their different privacy regimes, just as a similar challenge invalidated theprevious framework. Both rulings determined that U.S. laws and regulations granting government access to private individuals’ data for intelligence purposes made it impossible for companies engaged in trans-Atlantic data transfers to ensure that E.U. citizens’ data would receive equivalent protection in the United States and in the European Union.

At the time of the Schrems II decision, more than5,300 companies—mostlysmall and medium-sized enterprises — relied on the framework to move personal data, such as employee records or customer names and email addresses, between Europe and the United States. While many of them continue to do so using standard contractual clauses, compliance under this method is more expensive and less uniform due to the Court of Justice’s follow-uprulingthat when using them, data exporters must verify on a case-by-case basis that the destination country provides E.U. citizens’ data with equivalent protection or, if necessary, ensure that “supplementary measures” are adopted. Implementing a new framework would reduce compliance costs and generate efficiencies for companies operating in both markets, especially for SMEs for whom compliance under the standard contractual clause approach represents a disproportionate cost relative to their size.

现在一线希望更耐用solution. Shortly after the May 2022 meetings of the U.S.-E.U. Trade and Technology Council, officials announced anagreement in principleon a new data transfer framework. A forthcomingexecutive orderis set to guide implementation on the U.S. side. Though details are scant, acourt challengeis inevitable: The eponymous Max Schrems maintains that an executive order is an insufficient guarantee of privacy protection for E.U. citizens.

E.U. mistrust of U.S. data handling forms a shaky foundation for a new framework

A perennially skeptical European public — specifically when it comes to U.S. data privacy practices — is likely to serve as an additional roadblock to an enduring resolution by preventing European national authorities from pushing back too forcefully against a Schrems-style legal challenge.

Generally speaking, E.U. and U.S. adults trust one another quite a bit. When asked to what degree they trust the other party on a range of 14 foreign policy issues, adults in France, Germany, Italy and Spain more often than not trust their U.S. counterparts on eight of them. But they reported the least trust in the United States to store and manage their personal data. Only the Spanish are more likely than not to trust the U.S. to handle their personal data (second figure below). Across all four countries, distrust of the United States prevails on this front.

Europeans’ doubts arewell-founded. Years after WikiLeaks sparked concerns in Europe about U.S. intelligence services having access to E.U. citizens’ personal data, recentreportingon the U.S. government’s ongoing data collection initiatives suggests not all that much has changed.

By contrast, data nativism is less prevalent in the United States. U.S. adults are roughly equally split on the issue, with a third trusting the European Union to store and manage Americans’ personal data, a third distrusting it, and a third unsure.

Companies should wait for the dust to settle before going all-in on the new framework

U.S. implementation of a new privacy framework via executive order will give the agreement a more robust foundation than previous iterations, which centered around designating a senior bureaucrat as an ombudsman to handle E.U. citizens’ complaints. But it may not be enough to overcome the inevitable legal challenge claiming that the new framework still does not provide equivalent protection to E.U. law, given the relatively strong public skepticism.

大公司有足够的资源来解决with compliance requirements under the existing workaround approach involving standard contractual clauses should continue to do so in the interim. Large companies as well as small and medium-sized enterprises should also wait to see how legal challenges shake out in the E.U. Court of Justice before making costly adjustments to align their data transfer practices with the new framework.