The U.S. Department of Commerce and the European Commission announced Monday that they have initiated discussions "to evaluate the potential for an enhanced EU-U.S. Privacy Shield framework to comply with the July 16 judgement of the Court of Justice of the European Union in the 'Schrems II' case." Last month's decision invalidated Privacy Shield and placed additional due diligence requirements on companies transferring European citizens' data to non-EU countries through standard contractual clauses. 

In the joint press statement, European Commissioner for Justice Didier Reynders and U.S. Secretary of Commerce Wilbur Ross highlighted the "vital importance of data protection and the significance of cross-border data transfers" to both regions. "As we face new challenges together, including the recovery of the global economy after the COVID-19 pandemic, our partnership will strengthen data protection and promote greater prosperity for our nearly 800 million citizens on both sides of the Atlantic." 

More than 5,000 companies were participating in the Privacy Shield arrangement in order to conduct trans-Atlantic data transfers before it was

ADVERTISEMENT

Cassie IAPP Leaderboard - Future-proofing your data, 2025 and beyond

On Monday, Reynders also tweeted, "I will now work closely with national data protection authorities and the @EU_EDPB. I will also reach out to my U.S. counterparts and look forward to working constructively with them to develop a strengthened and durable transfer mechanism." 

July's decision from the CJEU focused on U.S. government access to EU citizens' data that is transferred by companies back to the U.S. and the ability for EU citizens to have judicial redress. Specifically,

In light of the "Schrems II" case, the U.S. government would likely have to make changes to its surveillance laws, particularly within the Foreign Intelligence Surveillance Act, Executive Order 12333 and PPD-28. 

However, Morrison & Foerster's Robert Litt, who served as the former general counsel for the U.S. Director of National Intelligence during the Privacy Shield negotiations, said a political solution is needed. 

In an email to The Privacy Advisor, Litt said, "It is good that negotiations have restarted because a political solution is the only way to reconcile the competing interests of commerce, privacy and national security. There is a lot that the U.S. can do without legislation by way of transparency, some enhanced procedures, and a stronger and more independent redress regime, but the EU must recognize that we have a different legal system. And it’s important that companies affected by this decision on both sides of the Atlantic get involved and have their voices heard." 

DLA Piper Partner Andrew Serwin, CIPP/A, CIPP/C, CIPP/E, CIPP/US, CIPM, CIPT, said, "there is a potential path forward if there is a focus on both the scope of surveillance, including oversight, as well as all the remedies that are available." Leading up to the "Schrems II" case, Serwin provided the Irish Data Protection Commission a memorandum on U.S. surveillance law in the Irish High Court Case. He also testified in the High Court proceeding and recently wrote a

In a

In his comments to the IAPP Monday, Serwin pointed to "Increased roles for inspectors general, an enhanced ombudsperson, additional safeguards around surveillance, as well as other potential remedies all represent potential paths forward and all should be explored as part of the inevitable negotiations." 

"Striking the right balance on the enhancements will be critical if we are going to solve these issues," Serwin said. 

Looking at the history of EU-U.S. data transfers in the last 20 years, first with Safe Harbor, then with Privacy Shield, and the fact that both adequacy decisions were struck down by the CJEU, a path forward to a "Privacy Shield 3.0" may well be a difficult one. 

Max Schrems, who successfully challenged Safe Harbor and Privacy Shield, suggested that the U.S. will need to change its surveillance laws or face a third challenge in court. 

Ustaran summed up the current situation: "The 'Schrems II' decision makes it clear what the focus of any enhancements needs to be: greater limitations on surveillance powers and effective remedies for individuals." 

"It is now up to the imagination and efforts of the U.S. government and the European Commission to come up with formulas to achieve that." 

Photos by Ben White and by Christian Wiediger on Unsplash