Privacy Shield
It has taken two years, but there is finally an agreement over how US companies, including Google and Facebook, will transfer their users’ data out of Europe

Europe sought to plug a gap in a new transatlantic data pact on Monday by urging US firms to allow European Union privacy regulators to police compliance with the new rules.

Brussels and Washington clinched a deal earlier this month on a new data transfer framework aimed at helping firms from both blocs seamlessly shuffle data between continents.

The deal was two years in the making and replaces a previous agreement struck down for failing to adequately protect Europeans’ data, which underpins $260bn in digital services trade across the Atlantic.

Companies shuffle data from Europe to the United States to complete routine activities such as credit card transactions and hotel bookings. Data transfers also underpin the business models of technology companies such as Google and Facebook, which collect users’ data to deliver targeted ads.

While companies transferring human resources data will be forced to comply with European Union privacy watchdogs’ decisions in disputes, for other companies it is voluntary.

However, the new “Privacy Shield” will be subject to an annual review to ensure companies moving data to the United States are abiding by EU data protection standards and the US government is not conducting mass indiscriminate surveillance.

The previous framework, Safe Harbour, was quashed by a top EU court last year after revelations about US government surveillance caused political backlash in Europe.

To help substantiate that US government access to data is usually targeted and avoid a suspension by the EU of the new framework, the European Commission urged US companies to release aggregate figures of government access requests and submit to oversight by EU data protection authorities.

“Transparency reports ... will contribute to maintaining confidence that such access is limited to what is necessary and proportionate,” it said, as details were published and sent to member states for approval.

The main enforcers of the framework will be the US Department of Commerce and the US Federal Trade Commission after Washington resisted EU pressure for a greater role for European data protection authorities in enforcing the pact, which has been criticised by privacy advocates.