The Supreme Court’s recent FBI v. Fazaga decision regarding surveillance has been interpreted by some as an obstacle to Biden administration efforts to secure an effective replacement for the EU-U.S. Privacy Shield. Originally implemented in 2016, thousands of U.S. companies had been relying on the Privacy Shield to centralize customer data. In 2020, the Court of Justice of the European Union (CJEU) nullified the framework after finding U.S. surveillance laws provide a loophole for unauthorized access to data belonging to EU citizens. Earlier today however, the U.S. and European Union agreed “in principle” to a revamped framework for data transfers.

The new agreement for cross-border transfers should provide “some much-needed relief for tech giants like Meta and Google,” reports CNBC. “Meta had warned it may shut down Facebook and Instagram in Europe over uncertainty surrounding EU-U.S. data flows.”

While details have yet to be revealed, the agreement will “enable predictable and trustworthy data flows between the EU and U.S., safeguarding privacy and civil liberties,” said Ursula von der Leyen, president of the European Commission.

But it may be too soon to determine whether the new agreement will serve as an effective replacement for the EU-U.S. Privacy Shield and the earlier Safe Harbor data pact that the Privacy Shield replaced. According to data protection expert Guillaume Couneson of London-based law firm Linklaters, the “new solution will have to withstand the scrutiny of the supervisory authorities and the privacy activists that brought down the two previous ones.”

Companies that have continued to transfer EU data have been slapped with fines totaling $1.2 billion as of January, according to an earlier report from CNBC that cited Amazon’s penalty at $850 million and $258 million for Meta Platforms.

Now the ACLU is urging Congress to revise the laws which the CJEU finds an obstruction. “Specifically, the court found that U.S. surveillance authorities, including Section 702 of the Foreign Intelligence Surveillance Act (FISA) and Executive Order 12333, permit unjustifiably broad government surveillance,” a pair of ACLU attorneys opine in The Hill.

“In striking down Privacy Shield, the CJEU was clear: no EU-U.S. data-transfer agreement will survive the court’s scrutiny” until the U.S. Congress narrows the scope of its surveillance laws, the ACLU law duo writes.

The case, which originated as Fazaga v. FBI, stems from a 2006 FBI sting targeting Islamic worshipers in Orange County, California. Using a “state secrets” defense, the FBI succeeded in having most of the charges dismissed in U.S. District Court, but the petitioners prevailed at the Ninth Circuit Court of Appeals. The Supreme Court reversed, ruling that “Congress did not eliminate the state secrets privilege for spying cases when it enacted watershed surveillance reforms in FISA, after an earlier era of abuses,” per The Hill.

“The decision could make it easier for the government to shield such information from judges, and therefore harder for most people challenging surveillance to prove their claims and obtain justice in court,” the ACLU attorneys write in The Hill.

Although the Privacy Shield was invalidated by the CJEU, the court “maintained the validity of standard contractual clauses, another mechanism for ensuring EU-U.S. data flows are legally sound. However, firms are still scrambling to figure out the implications of the ruling,” reports CNBC, noting that Big Tech has collectively shouldered the brunt of a collective $1.2 billion in fines against U.S. companies that have continued to export data.

“Officials on both sides of the Atlantic had been struggling to bridge an impasse over what it means to give Europeans’ effective legal redress against surveillance by U.S. authorities,” notes Politico regarding today’s announcement of a preliminary new agreement. “Not all of those issues have been resolved, though von der Leyen’s comments Friday suggest technical solutions are within reach.” Meanwhile, “any deal is likely to be challenged in the courts by privacy campaigners.”

Related:
European Lawmakers Reach Deal on Sweeping New Digital-Competition Law, The Wall Street Journal, 3/24/22
EU Takes Aim at Big Tech’s Power with Landmark Digital Act, The New York Times, 3/24/22