UPDATE - Biden signs order directing implementation of EU-US Data Privacy Framework

ADDS DETAILS THROUGHOUT; EDITS DECK

By Michael Hernandez

WASHINGTON (AA) - US President Joe Biden signed on Friday a new executive order directing the implementation of a new framework to protect data transfers between the EU and the US estimated to enable some $7.1 trillion in bilateral trade.

The EU-US Data Privacy Framework (DPF) seeks to address concerns raised by the European Court of Justice when it overturned a previous version known as the EU-US Privacy Shield framework in 2020. The court ruled in that case, known as Schrems II, that the framework granted the US too great an ability to surveil European data when it was transferred across the Atlantic.

The White House said those concerns have been alleviated by the current version, saying Biden's order "bolsters an already rigorous array of privacy and civil liberties safeguards for U.S. signals intelligence activities."

"It also creates an independent and binding mechanism enabling individuals in qualifying states and regional economic integration organizations, as designated under the E.O., to seek redress if they believe their personal data was collected through U.S. signals intelligence in a manner that violated applicable U.S. law," it said, referring to an executive order.

The new framework "represents the culmination of a joint effort" between the US and the European Commission "to restore trust and stability to transatlantic data flows and reflects the strength of the enduring EU-U.S. relationship based on our shared values," according to the White House.

It further limits US surveillance activities to "be conducted only in pursuit of defined national security objectives," and they must take into consideration the privacy and civil liberties of all parties, regardless of nationality, and be conducted "only when necessary to advance a validated intelligence priority," the White House said.

Biden's order directs Attorney General Merrick Garland to establish what is to be known as a Data Protection Review Court (DPRC), which will be comprised of judges from outside of the US government with expertise in data privacy and national security. Individuals and members of the community can apply to the court to seek redress.

"Decisions of the DPRC regarding whether there was a violation of applicable U.S. law and, if so, what remediation is to be implemented will be binding," the White House said.