US ‘will not engage in indiscriminate mass surveillance’ under new data deal

The US has guaranteed it will not engage in "indiscriminate mass-surveillance" of European citizens under a deal struck to ensure the protection of personal data transferred from the EU across the Atlantic, the European Commission has said.

An agreement to replace the Safe Harbour arrangement approved by the European Commission 15 years ago for the transfer of such data will be replaced by a new one to be known as EU-US Privacy Shield, the commission said on Tuesdasy.

Safe Harbour was struck down last October by the Court of Justice of the European Union, essentially because it was not capable of ensuring adequate protection for the data of EU citizens due to the level of mass surveillance engaged in by US national security authorities.

US and EU authorities have negotiated day and night for several months to find an alternative by the end of January.

The EU’s data protection authorities had threatened to start barring the transfer of personal data to the US if an agreement was not reached by then - a potentially catastrophic business scenario for many firms and multinationals.

Announcing the Privacy Shield deal on Tuesday, vice president for the digital single market Andrus Ansip and commissioner for justice Vera Jourová said the new framework would ensure the right checks and balances for EU citizens.

Ms Jourová said the deal was a “safe framework for the future of transatlantic data flows” and that it had come after “very tough” negotiations.

‘Binding assurances’

The US had for the first time given “binding assurances” that access to personal data for national security and law enforcement would be subject to limitations, safeguards and an oversight mechanism.

Any exceptions must be used “only to the extent necessary and proportionate”.

“The US has ruled out indiscriminate mass surveillance on the personal data transferred to the US under the new arrangement.”

She appreciated this “unique step” the US had made in order to restore trust in transatlantic relations and the commission would “hold the US accountable on the commitments they made”.

The US will, under the framework, create the role of a special ombudsman within the US Department of Commerce to investigate complaints by European citizens about access to their data by the security authorities.

The ombudsman will be independent and complaints will be referred to the office by national data protection authorities.

The data-transfer deal will be subject to a joint review by the EU and US authorities every year, starting next year.

Ms Jourova will inform EU data protection commissioners of the full details at their meeting in Brussels tomorrow.

The arrangement announced on Tuesday is still subject to a so-called “finding of adequacy” by the European Commission, which means it yet has to sign off on EU-US Privacy Shield as providing an adequate level of protection for citizens’ personal data.

Privacy and legal experts have warned for months that any deal reached to replace Safe Harbour would be just as open to challenge before the Court of Justice.

Asked on Tuesday if he believed the new deal could withstand such a court challenge, Mr Ansip said the idea for Safe Harbour had been a good one in 2000 but that the possibilities of mass surveillance had not been imagined at the time.

He said the package was “binding” and had been signed “on a very high level”.

Austrian privacy campaigner Max Schrems, whose case against the Irish Data Protection Commissioner over its refusal to investigate Facebook’s data transfers to the US was referred to the Court of Justice, said he was not sure if the system would stand.

“There will be clearly people that will challenge this – depending on the final text I may well be one of them.”