European Commission and U.S. officials today announced reaching a “political agreement” on a new Safe Harbor framework. The new framework will be called the “EU-U.S. Privacy Shield.” In a press conference and a press release today, European officials highlighted the following points about the new framework:

• Limitations on surveillance: Commission officials report that the U.S. has provided “written assurances” that “the access of public authorities for law enforcement and national security will be subject to clear limitations, safeguards and oversight mechanisms.”
• Annual joint review: The agreement calls for an “annual joint review” between the U.S. Department of Commerce and the European Commission regarding the operation of the framework. This review will “include the issue of national security access.”
• Complaint and redress process: Companies will have mandatory deadlines for responding to complaints, and complaints can be referred from European regulators to the Department of Commerce and the Federal Trade Commission. European data subjects concerned about potential access to their data by U.S. national security authorities can register complaints with an “Ombudsperson.” An alternative dispute resolution process for managing complaints will also be provided.
• Submission to authority of European data protection authorities: Participating U.S. companies handling human resources data must “commit to comply with decisions by European DPAs.”

In October, the European Court of Justice invalidated the previous Safe Harbor framework. U.S. and EU officials have been working since that decision to finalize a successor agreement. Neither side has yet released a final written agreement related to the deal. Written formalization of the “political agreement” is expected in a few weeks.

In terms of next steps, the European Commission is preparing an “adequacy decision” in order for the “EU-U.S. Privacy Shield” framework to be enforceable.

Alston & Bird will continue to monitor developments with respect to the formal adoption of the “EU-U.S. Privacy Shield” and will provide additional guidance as the situation continues to develop.

The press release is available online.