President Joe Biden on Friday signed an executive order implementing a United States-European Union agreement on new cross-border data privacy protections, protections that have been on shifting sands since an international court threw out a previous agreement.

The Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities (E.O.) outlines the steps the U.S. is taking under the new EU-U.S. Data Privacy Framework. The framework is essentially a data protection safe harbor for companies that agree to comply with it.

Those steps include providing companies with greater legal certainty by creating an independent and binding process for individuals who believe their personal data was collected in violation of U.S. law. It also mandates handling requirements for personal information and requires U.S. intelligence agencies to update their policies and procedures in line with those new protections.

Allowing digital goods to flow freely across borders is worth $7.1 trillion in commerce between the EU and the U.S., the White House said, and is key to American companies participating in a world economy.

A new agreement was needed after the EU’s Court of Justice ruled the U.S. couldn't live up to its part of agreement to protect data privacy. Concluding that it did not sufficiently protect data transferred from the EU to the U.S. — particularly involving U.S. government intelligence agency access — the Court of Justice in July 2020 invalidated the so-called privacy shield, prompting the EU and U.S. to get to work on a successor agreement that would pass court muster.

Among those welcoming some of that greater certainty when it comes to how data is protected comes from the computer companies vital to those flows.

“Since that EU court ruling, the two economies have been without clear guidelines for data transfers on the most trafficked route on the globe — impacting transactions such as travel reservations, social media communications, and insurance claims that implicate trillions of dollars of annual economic activity," the Computer & Communications Industry Association (CCIA) said.

“We appreciate President Biden’s action to keep data flowing between the U.S. and EU, underpinning one of our deepest and most mutually beneficial trading relationships," CCIA president Matt Schruers said. “Data transfers are at the heart of the transatlantic relationship, fueling the trade that keeps both of our economies running and brings benefits to consumers and businesses of all sizes who need legal clarity on mechanisms to transfer data.”

Online advertisers, who rely on free flows of information in which to place their messages, were also pleased with the order.

“Today, the Biden administration has taken a big step forward, announcing stronger protections for data transferred to the U.S. and setting the stage for a final agreement with our allies,” Interactive Advertising Bureau executive VP of public policy Lartease Tiffith said. “Data flows are crucial for the mutual development of medical, cybersecurity and other technologies, as well as media, advertising and consumer goods. With so many disruptions to commerce during the last few years, IAB is excited about this new development to ensure secure cross-border data flows. IAB looks forward to working with the EU and U.S. to fully implement the new agreement.”

BBB National Programs certainly saw a better digital business climate on the horizon.

“At BBB National Programs, we commend the White House, the U.S. Department of Commerce, and their counterparts in the European Commission for lifting the cloud of uncertainty that has been hanging over Privacy Shield for more than two years,” the organization said in a statement. “As the longest-running Independent Recourse Mechanism (IRM) provider, the first recognized under Privacy Shield, trusted for more than 20 years by businesses of all sizes, we view this formal commitment to the EU-U.S. Data Privacy Framework as a huge milestone for the $7 trillion trans-Atlantic economy.”

Jason Oxman, president and CEO of tech trade group the Information Technology Industry Council (ITI), said: “Today’s actions will help restore business certainty and safeguard continuity of key business operations as data moves across the Atlantic, while also upholding European citizens’ fundamental rights, and the security and public safety interests of the U.S., EU, and other qualified states. We appreciate the Biden Administration’s attention to this critical issue and look forward to working with the European Union to implement the EU-U.S. Data Privacy Framework over the coming months.” ■

The Trump Administration has started to huddle with the European Commission to talk about enhancing the EU-U.S. Privacy Shield after the EU's Court of Justice ruled that the U.S. can't live up to its part of the bargain, promising to strengthen privacy protections. 

Concluding that it does not sufficiently protect data transferred from the EU to the U.S., the Court of Justice last month invalidated the "privacy shield." 

"The U.S. Department of Commerce and the European Commission have initiated discussions to evaluate the potential for an enhanced EU-U.S. Privacy Shield framework to comply with the July 16 judgment of the Court of Justice of the European Union in the Schrems II case," said Commerce Secretary Wilbur Ross and EU commissioner for Justice Dider Reynders in a joint statement Monday (Aug. 10). "This judgment declared that this framework is no longer a valid mechanism to transfer personal data from the European Union to the United States. 

Related: FTC Cracks Down on Alleged Privacy Shield Pretenders 

"The European Union and the United States recognize the vital importance of data protection and the significance of cross-border data transfers to our citizens and economies. We share a commitment to privacy and the rule of law, and to further deepening our economic relationship, and have collaborated on these matters for several decades."   

"As we face new challenges together, including the recovery of the global economy after the COVID-19 pandemic, our partnership will strengthen data protection and promote greater prosperity for our nearly 800 million citizens on both sides of the Atlantic." 

The shield was a way for U.S. companies to be considered in compliance with the EU's General Data Protection Regulation simply by signing on to the shield's data protection guarantees, rather than having to come up with individual policies and agreements to comply with the GDPR protections of cross-border data flows.  

In invalidating the shield the court said data protections in U.S. laws "are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law."  

Now Commerce and the EU will have to find a way to get the U.S. data protections on the same page as the EU. 

Related: FCC, FTC Chairs Defend Privacy Rules Rollback

The FCC under former chairman Tom Wheeler approved tough U.S. data privacy rules, but they were invalidated by Republicans in Congress despite pushback by privacy groups and Democrats who have called for a consumer privacy "bill of rights."

“Cross-border data flows are pivotal to the $1.3 trillion trading relationship between the U.S. and EU and are relied upon by the more than 5,300 Privacy Shield-certified businesses," said Jason Oxman, president of tech association ITI. "We’re encouraged that the U.S. and EU have begun talks on a successor framework in the wake of the CJEU’s decision in the Schrems II case, and the tech industry is committed to working with all stakeholders in the development of such framework to protect individuals’ personal data while supporting innovation and the free flow of data.”   

The Federal Trade Commission has finalized a settlement with tech company Medable for falsely claiming its privacy policy was in compliance with the EU-U.S. Privacy Shield framework. 

Compliance gives companies a safe harbor from which to transfer consumer's data from European countries to the U.S. 

Related: FTC Cracks Down on Alleged Privacy Shield Pretenders 

The FTC had alleged that the company had falsely claimed that it was a certified participant in the shield. Medable can no longer make such a misrepresentation about the shield or any other self-regulatory or standard setting body. The vote on the settlement was 5-0. 

Related: EU Says Privacy Shield is Working 

The privacy shield replaced the safe harbor agreement that a European Union court invalidated in October 2015 over concerns about the U.S. being able to hold up its end of the agreement given the government surveillance revealed by the Edward Snowden leaks. The voluntary framework requires companies to provide notice of what personal information is being collected and stored, the purposes it is used for, and an "opt out" mechanism.