This has been the case since the EU court ruling in October 2015 struck down the status of the US as a 'safe' destination for personal data, saying it did not uphold the fundamental rights of privacy due to the mass surveillance employed by security forces, nor a right to judicial redress for non-Americans in the event personal data is misused. Following the court ruling, the so-called Article 29 Working Party, which units the EU's privacy regulators, set a deadline of early February for the EU and US to reach a new agreement on how to protect the personal data of EU citizens transferred to the US. A new agreement, called the 'Privacy Shield', was presented in Brussels on 2 February, but must still be vetted by the privacy regulators and EU officials.
The Article 29 group called on the European Commission to ensure it has all the necessary documents by the end of February so the regulators can proceed with a thorough evaluation of the proposal. In a statement, the regulators said they recognise the efforts the US has made in the past two years to improve the protection of data of non-US persons, but they still have concerns about whether the US legal framework upholds key rights in EU law, especially regarding the scope of protection and remedies. In addition to upholding EU rights, the new agreement will be evaluated to see whether the contract clauses and corporate rules currently in use in data protection policies are legitimate tools and whether the powers of EU data protection authorities are respected.
