I am glad to announce today that we have finalised negotiations with the United States on a renewed and safe framework for transatlantic data flows.
I have just concluded talks with U.S. Commerce Secretary Pritzker. And I am very glad that the College of Commissioners has today supported the conclusion of the negotiations on what I think is a strong and safe framework for the future of transatlantic data flows.
This result comes after very tough negotiations, especially over the past 3 months, where we have worked literally day and night to find an arrangement that protects the fundamental rights of Europeans and ensures legal certainty. Before I go into the key points of the new arrangement I would like to thank everyone who contributed to achieving this.
First of all I would like to thank my counterpart in negotiations in the US, Penny Pritzker, with whom I spent many hours in person and on the phone.
I want to thank President Juncker for his continuous support throughout the negotiations and my Colleagues in the Commission, particularly First Vice-President Timmermans and Vice-President Ansip, who also played a very active role in that process.
And last but not least I want to thank our negotiators, who have worked on this for more than two years now and did a great job on something that was both a very legally complex and politically sensitive exercise.
Let me now explain what we have achieved:
This new framework for transatlantic data flows protects the fundamental rights of Europeans and ensures legal certainty for businesses. The new arrangement lives up to the requirements of the European Court of Justice. It will also be a living mechanism, which will be reviewed continuously to check whether it functions well.
There are three main achievements:
We have achieved clear safeguards and transparency obligations on U.S. government access to data.
For the first time ever, the United States has given the EU binding assurances that the access of public authorities for law enforcement and national security will be subject to clear limitations, safeguards and oversight mechanisms. The US will provide written assurances, notably from the Office of the Director of National Intelligence in the White House. This is a unique step the US has made in order to restore trust in our transatlantic relations. I commend them on going this step, at the same time it is also clear that we will of course hold the U.S. accountable on the commitments made. It is a precondition for our unilateral decision to give adequacy to the framework.
We have also agreed to monitor the functioning of this arrangement. The Commission and the Department of Commerce will do an annual joint review which will serve to substantiate the commitments made. We will associate US national security experts and EU Data Protection Authorities in that monitoring. In this way, the U.S. will be held accountable to its commitments. I informed Ms. Falque-Perrotin, the Chair of the Working Party 29 of all EU Data Protection Authorities, this morning about this major achievement, which is fully in line with the strengthened role of the Data Protection Authorities now. And I will also inform the EU Data Protection Authorities personally about the agreement reached at their meeting tomorrow.
Also for the first time, EU citizens will benefit from redress mechanisms in the area of national security access. In the context of the negotiations for this agreement, the US has assured that it does not conduct mass or indiscriminate surveillance of Europeans.
We achieved effective protection of European's right.
Any citizen who considers that their data has been misused under the Safe Harbour scheme will benefit from several accessible and affordable dispute resolution mechanisms:
Ideally, and from experience, the complaint will be resolved by the company itself.
There will be free of charge Alternative Dispute resolution (ADR) solutions.
Individuals can go to EU Data Protection Authorities, who will work together with the Federal Trade Commission to ensure that complaints by EU citizens are investigated and resolved. These cases should be resolved in a reasonable timeframe: if DPA refers a case to the US, the Department of Commerce will have a deadline to respond.
If a case is not resolved by any of the other means, as a last resort there will be an arbitration mechanism.
Redress possibility in the area of national security for EU citizens' will be handled by an Ombudsman independent from the US intelligence services. This is a new tool specifically foreseen for this arrangement.
Once the judicial redress act is passed, EU citizens will for the first time have access to US courts in the context of personal data being used for law enforcement purposes.
Last but not least there will be strong obligations on companies handling the data:
- There will be regular updates and reviews of participating companies by the Department of Commerce.
- The new arrangement will be transparent and contain effective supervision mechanisms to ensure that companies follow the rules they submitted themselves to. If companies do not comply in practice they face sanctions and removal from the list.
- There will be tightened conditions for onward transfers to other partners by the companies participating in the scheme.
The College has today mandated VP Ansip and myself to now prepare a draft "adequacy decision" in the coming weeks, which could then be adopted by the College following the foreseen procedure. Also the American side will need a few weeks to make the necessary preparations and formalize all the commitments made to put in place the new framework.