The U.S. White House and the European Commission released, on 25 March 2022, joint statements and factsheets on the 'agreement in principle' for a new Trans-Atlantic Data Privacy Framework. In particular, the two bodies highlighted that the new framework aims to:

• establish new safeguards will be put in place to ensure that US signals surveillance activities are necessary and proportionate in the pursuit of defined national security objectives;
• establish a two-level independent redress mechanism with binding authority to direct remedial measures, and which includes a Data Protection Review Court;
• enhance oversight of US signals intelligence activities to ensure compliance with limitations on surveillance activities; and
• ensure that there will be strong obligations in place for organisations, with participating companies and organisations being required to continue adhering to the Privacy Shield Principles, and to self-certify their adherence to these principles.

In addition, the two bodies detailed that there will be strong obligations in place for organisations, with the White House further outlining that participating companies and organisations must continue to adhere to the Privacy Shield Principles, and to self-certify their adherence to these principles, while EU individuals will have access to multiple recourse avenues for resolving complaints, including through alternative dispute resolution and binding arbitration.

Finally, the two bodies highlighted that this agreement in principle will now be translated into legal documents which must be adopted by both sides in order to put in place the new framework. Moreover, the White House noted that for this purpose, these commitments from the US will also be included in an Executive Order, forming the basis of the European Commission's assessment in its future adequacy decision.

You can read the White House press release here and factsheet here, and the European Commission press release here and factsheet here.

UPDATE (28 March 2022)

NOYB issues statement in response to announcement

None of your business ('NOYB') issued, on 25 March 2022, a statement following the joint announcement that the EU and US had reached an agreement in principle for a new Trans-Atlantic Data Privacy Framework. In particular, NOYB noted that it expects the development of a legal text to take a couple of months to be drafted, with lawyers involved in the negotiations still needing to find fully functioning solutions to the issues raised by the Court of Justice of the European Union in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('the Schrems II Case').

Max Schrems, Honorary Chairman of NOYB and lead litigant in the Schrems II Case, commented, "The final text will need more time, once this arrives we will analyse it in depth, together with our US legal experts. If it is not in line with EU law, we or another group will likely challenge it. In the end, the CJEU will decide a third time. We expect this to be back at the CJEU within months from a final decision."

You can read the statement here.