Data transfers between the US and the EU have always been sticky business at best, as with any kind of international data transfer, and will likely continue to be so well into the future. Making matters just a bit less complicated, however, was the “Safe Harbor” legal framework. In essence, it allowed free transfer of data with minimal protections or regulations; basically, the bare minimum legal framework to ensure data security and some form of recourse, should that security fail. Those “Safe Harbor” laws, however, were written in a different era of the internet, and were largely seen as irrelevant by the time they came up for renewal, as evidenced by the fact that it was dropped, and lawmakers on both sides were left to find a new agreement.
That new agreement came in the form of the EU-U.S. Privacy Shield framework. Unlike Safe Harbor, data security is paid significant attention in the wake of concerns over data surveillance in the US. While it is impossible to fully regulate and enforce more secure data transfers on such a large scale, the new laws do allow for much stronger retribution if data is breached or misappropriated, which will hopefully encourage self-enforcement of stronger data security from both parties involved. The protections side strongly with the EU in light of US data breaches and surveillance, as well as stronger enforcement of the Right To Be Forgotten act in recent years.
The vote to institute the EU-U.S. Privacy Shield laws last Friday was mostly a sweeping one, but did meet with some dissent in Austria, Bulgaria, Croatia, and Slovenia, with dissenting parties stating that the protections provided might not be stringent enough. A group representing American tech giants like Apple and Google said that Friday’s decision was cause for relief, despite the stronger protections in place. The abolishing of Safe Harbor, sparked by revelations from privacy researcher and former NSA contractor Edward Snowden, has seemingly come full circle, with full adoption of a new framework with stronger protections taking place to fully reinstate data-space relations between the US and the member states of the EU. The new law framework went into effect on Tuesday.