On Friday 25 March 2022, the US and EU announced they had reached a preliminary deal on data privacy - and suddenly there was a sigh of relief in relation to trans-Atlantic data flows. As yet no details of the new agreement have emerged so how issues, such as an effective appeal mechanism for EU data subjects or surveillance laws, have been resolved remains uncertain.

While the rhetoric is upbeat, as expected, with President Biden saying the “framework underscores our shared commitment to privacy, to data protection and to the rule of law” and the European Commission President Ms von der Leyen saying the agreement “will enable predictable and trustworthy data flows between the EU and U.S., safeguarding privacy and civil liberties”, some are already questioning how long any deal will last before it is challenged.

The news will be welcomed by many international businesses and in particular by big tech companies, especially those facing regulatory action – think Google in relation to the Google Analytics decisions from Austria, France and Lichtenstein or Facebook Ireland (now Meta Ireland) and the Irish Data Protection Commission’s revised preliminary order, the terms of which could have stopped Facebook Ireland from sending certain data to the US because of potential surveillance requests. If this new US/EU preliminary deal goes ahead suddenly these headaches disappear…well until the privacy activists scrutinise the terms of the deal and decide what grounds, if any, they have to challenge it.

Whatever the terms of the deal, many on both sides of the pond expect privacy activists to challenge it in court. There is a fundamental difference in ideologies and the approach to privacy between the EU privacy activists, such as Max Schrems and his NOYB organisation, and big tech and international businesses who rely on trans-Atlantic data flows. The theoretical possibility versus the practical reality is an ongoing debate when it comes to surveillance laws and has long been controversial. It is thought that if the deal doesn’t come along with legislative changes to US surveillance laws the Court of Justice of the European Union will follow a familiar path and it will be third time unlucky for the replacement mechanism. There is much speculation already about how long the proposed deal will last. As ever, it is a case of watch this space!