With a deadline of Tuesday looming, the United States and European Union have yet to agree on the details of a new safe harbor agreement, which will affect more than 4,000 companies.
“We are close, but an additional effort is needed,” said Věra Jourová, the EU commissioner for justice, consumers and gender equality, at a briefing in the European Parliament Monday night.
American and European negotiators have been scrambling for weeks to replace the safe harbor data transfer mechanism after the European Court of Justice (ECJ) struck it down in October. The court said Europeans’ personal information may not have adequate protection in the U.S.
In her update to Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE), Jourová indicated she still believed a replacement framework could be negotiated, but did not give a timeline.
EU and American negotiators worked through the weekend and Monday to finalize the details of a new pact before the Article 29 Working Party of the EU’s data protection authorities (DPAs) meets Tuesday.
Getting an agreement by the deadline is crucial: The DPAs had threatened to undertake mass enforcement if negotiators didn’t hammer out a new pact by January 31.
The last hope for negotiators is that they can show enough progress and gain more time.
Yet two main elements remain: How to ensure all individual EU complaints about data transfers are sufficiently investigated in the U.S., and how to protect Europeans’ data from mass surveillance by law enforcement.
On the first point, the U.S. has offered to create a new ombudsman within the State Department to oversee complaints, giving DPAs and Europeans a single point of contact.
Jourová stressed that regardless of the ombudsman and promises by the U.S. Federal Trade Commission to prioritize all DPA’s complaints, the EU wants a “last resort” mechanism to ensure every case is investigated and decisions are binding and enforceable.
Jourová continued negotiations into the evening with U.S. Commerce Secretary Penny Pritzker. On Tuesday, the Commission will brief both the EU’s data protection authorities and the College of Commissioners on progress.
Whether it will be enough to satisfy Europe’s data protection authorities, which are poised to start investigations, remains to be seen.
The worst case scenario for U.S. companies who were relying on the safe harbor mechanism and have no alternative arrangements in place: The DPAs get proactive and begin seeking out companies making illegal data transfers.
But on the second point, no company transferring data from the EU to the U.S. is safe, according to experts and some MEPs.
“It is obvious they are not there yet, and the explanations have been quite weak,” said Jan Philipp Albrecht, LIBE’s German vice-chair. “The ombudsperson is a nice idea, but what is the legal status and what decision power does he have?” he said after the meeting concluded. “They will need quite a lot of time to work this out so that it is watertight, and for the moment I can’t see that it is.”
On surveillance, the U.S. position has been consistent: National security authorities do not undertake mass and indiscriminate surveillance of Europeans’ data, particularly since the U.S.A. Freedom Act replaced the much-maligned Patriot Act, negotiators have stressed.
Jourová acknowledged that things were different in the U.S. since the 2013 revelations of mass surveillance by American whistleblower Edward Snowden. She said the EU has gotten “specific written assurances from the United States that access by public authorities to personal data transferred from Europe will be limited to what is necessary and proportionate.”
That prompted a hostile reaction from LIBE committee members, several of whom raised concerns that this was insufficient, particularly in light of the upcoming presidential election.
“These letters will be taken by our side as legally binding ones,” Jourová responded. “Some of you mentioned the elections in the United States. Well, we don’t have another choice other than to expect continuity. If not, then we will have to suspend the system. That is absolutely clear.”
The next 36 hours are crucial for Commissioner Jourová and for the future of EU-U.S. data transfers.