Draft of new US-EU data transfer deal sent to EU member states

The European Union and the United States have agreed to revisions to a key transatlantic data transfer pact, which place further limits on both U.S. surveillance and the length of time firms can retain personal data.

{mosads}The new version of the so-called Privacy Shield agreement was sent to the 28 EU member states for review overnight, Reuters reports.

The EU is slated to hold a vote on the document in early July, several EU sources told the publication.

The U.S. government has given a more detailed explanation of the conditions under which intelligence agencies might collect personal data in bulk, as well as the limits on how that data is used, sources said.

The new draft also places more severe limits on the length of time that American firms can keep citizens’ data. 

Privacy Shield is intended to replace a 15-year-old framework used by U.S. companies to make legal transfers of personal data across the Atlantic. The old Safe Harbor arrangement was used by over 4,000 companies, from hospitality to social media, to meet Europe’s more stringent privacy requirements for handling citizens’ data.

The EU high court struck down the agreement in October, on the basis that the U.S. could not be seen to adequately protect privacy because of its surveillance practices.

Negotiators have struggled to craft a replacement to the critical deal but have faced an uphill road in convincing Europe’s 28 data privacy regulators. The bloc’s lead watchdog in May said a draft deal struck in February needs “robust improvements.”

It remains to be seen if the new deal will receive approval from the various EU member states. Critics have long warned that unless the U.S. overhauls its privacy and national security laws, no legal framework could stand up in European courts.

The deal also comes amidst widespread uncertainty in the EU after Britain on Thursday voted to exit the bloc.