Europe and the U.S. finally agree a landmark data-sharing pact — and it’s already under threat
The Privacy Shield Framework logo is displayed on a smartphone screen.
Pavlo Gonchar | Sopa Images | Lightrocket | Getty Images
Businesses can continue transferring data from the European Union to the U.S. as normal after the two superpowers this week agreed a landmark data-sharing pact.
The framework, which replaces a previous agreement that was invalidated in 2020, is a major development with implications for U.S. tech giants, which rely on the pact to transfer data on their European users back to America.
Without it in place, these companies faced the risk of costly initiatives to process and store user data locally — or withdraw their business from the bloc altogether. So the agreement of the new rules will provide some relief to Meta and other U.S. companies which share gargantuan amounts of user data around the world.
However, the rules already face the threat of legal challenges from privacy activists, who are unhappy with the level of protection the measures offer European citizens. They say it isn’t that different from an earlier framework called Privacy Shield.
CNBC runs through all you need to know about the new EU-U.S. privacy framework, why it matters, and its chances of success.
What’s the new EU-U.S. Data Privacy Framework?
The new data-sharing pact, called the EU-U.S. Data Privacy Framework, aims to ensure that data can flow safely between the EU and U.S., without having to put in place additional data protection safeguards.
In a statement Monday, EU executive body the European Commission said it concluded that U.S. data protection laws offer an “adequate level of protection” for European citizens, and introduced new safeguards limiting access to EU data by U.S. intelligence services to only what is “necessary and proportionate.”
A new Data Protection Review Court will be established for Europeans to issue privacy complaints. It will have powers to order firms to delete users’ data if it finds the information collected was in breach of the new safeguards.
Why was a new data transfer agreement needed?
The Data Privacy Framework replaces a prior agreement, called Privacy Shield, which allowed companies to share data on Europeans to the U.S. for storage and processing locally in their domestic data centers.
This was struck down in July 2020, when the European Court of Justice, the EU’s top court, sided with Austrian privacy campaigner Max Schrems, who alleged U.S. law did not offer sufficient protection against surveillance by public authorities.
Schrems said that revelations from NSA whistleblower Edward Snowden about U.S. surveillance meant that American data protection standards couldn’t be trusted.
He raised a complaint against the social network Facebook which, like many other firms, was transferring his and other user data to the States, as well as the Irish Data Protection Commission, which is Facebook’s main regulatory authority when it comes to data privacy in Europe.
It reached the European Court of Justice, which in 2015 ruled that the then Safe Harbour Agreement, a previous mechanism for allowing European users’ data to be moved to the U.S., was not valid and did not adequately protect European citizens.
It was replaced with the Privacy Shield, however, this was subsequently scrapped too.
In the meantime, companies have relied on separate mechanisms known as Standard Contractual Clauses to ensure they can still move data across the Atlantic.
These tools, too, are under threat.
The Irish DPC in May ruled that Meta’s use of SCCs for transfers of personal data to the U.S. is in breach of the EU’s General Data Protection Regulation. The U.S. tech giant was fined a record $1.3 billion.
Why does it matter?
Multinational companies operate in various jurisdictions, and they need to move data on their customers across borders in a way that’s both secure and complies with data protection regulations.
U.S. tech giants share data on their European users back home all the time. It’s part and parcel of the internet being an open, interconnected platform.
But the way data is handled by these tech companies has come under heavy scrutiny by regulators and privacy campaigners.
Meta, Google, Amazon and others collect huge amounts of data on their users, which they use to inform their content recommendation algorithms and personalize ads.
There have also been countless examples of scandals surrounding the misuse of people’s data by tech firms — not least Meta’s improper sharing of data with Cambridge Analytica, the controversial political consulting firm.
Europe has tough regulations when it comes to processing internet users’ data.
In 2018, the General Data Protection Regulation, or GDPR, came into force introducing tough requirements for organizations to ensure they handle user data safely and securely. This is a law that applies across all the countries within the EU.
The U.S., on the other hand, does not have a singular federal data protection law in place that covers the privacy of all types of data.
Instead, individual U.S. states have come up with their own respective regulations for data privacy, with California leading the charge.
“There has been intense regulatory and political scrutiny on EU-U.S. data transfers, so there are notable differences in the U.S. law protections implemented to support the new framework,” Holger Lutz, partner at law firm Clifford Chance, told CNBC via email.
“Changes to U.S. law have been made in parallel to enhance protections for EU personal data and rights for EU citizens in connection with that data. Those protections are not limited to the new framework – they also protect EU-U.S. personal data transfers outside the framework, and can be taken into account when making such transfers based on other legal instruments such as the EU standard contractual clauses.”
Will it succeed?
The approval of a new data privacy framework means that businesses will now have certainty over how they can process data across borders going forward.
Had there not been an agreement, some companies may have been forced to close their operations in Europe. Indeed, Meta warned this was a risk in February 2022.
Still, obstacles lie ahead.
Schrems, the Austrian privacy activist who helped bring down Privacy Shield, has already said he plans to launch a legal challenge to rip up the new data-sharing pact.
In a statement, Schrems said his law firm Noyb has “various options for a challenge already in the drawer.”
“We currently expect this to be back at the Court of Justice by the beginning of next year,” Schrems said.
“The Court of Justice could then even suspend the new deal while it is reviewing the substance of it. For the sake of legal certainty and the rule of law we will then get an answer if the Commission’s tiny improvements were enough or not.”
Privacy activists say the measures are not sufficient as U.S. privacy laws do not extend protections to non-U.S. citizens, meaning people in the EU don’t have the same level of protection.
“Whether the framework is successful will be a matter of whether the European courts consider the protections for personal data in the US do enough to deliver essential equivalence to the EU protections,” Lutz of Clifford Chance told CNBC.
“Businesses will be carefully considering these potential challenges in their scenario planning.”
Dell, HP, and Lenovo laptops equipped with Intel Core Ultra processors, optimized for premium thin and powerful laptops, featuring 3D performance hybrid architecture, advanced AI capabilities, and built-in Intel Arc GPU, on display at the Consumer Electronics Show (CES) 2025, in Las Vegas, Nevada, USA, on January 8 2025.
Artur Widak | Nurphoto | Getty Images
Personal computer shipments rose in the first quarter of the year as companies sped up deliveries to gear up for incoming tariffs.
Research firm Canalys estimates that shipment for PCs jumped more than 9% during the period, while data from IDC Research pegged the growth at nearly 5% from a year earlier. That equated to roughly 63 million units.
Companies worldwide are bracing for the knock on effects from President Donald Trump’s sweeping tariff plans, which threaten to suppress demand for computers and other electronics that largely rely on Asian countries for manufacturing.
“The market is clearly showing some level of pull-in in the first quarter this year as both vendors and end-users brace for the impact of US tariffs,” IDC wrote.
Concerns about a slowing economy and a decline in discretionary spending have pressured global markets in recent days, and pushed some consumers to stock up on products impacted by the levies. The PC market has been largely stagnant in recent years following a surge in purchases during the pandemic. In 2024, shipments increased 1% after two straight years of declines, according to IDC.
The latest round includes a 104% tariff on goods imported from China, home to hefty amounts of PC manufacturing. Vietnam, Thailand and India, which are responsible for a growing number of electronics production, also face import tariffs.
IDC’s Ryan Reith told CNBC that some original design manufacturers have already weighed holding back sending out additional PCs as the retaliatory tariffs went into effect.
“The real interesting stuff is in front of us,” Reith said. “It’s either going to be inventory backup, you keep sending something somewhere where no one’s buying it, and it builds up inventory, or nothing gets sent over here.”
Canalys said notebook shipments grew 10% during the period to more than 49 million units, while desktop shipments rose 8%. The U.S. saw the biggest increase, but shipments will likely ease as “inventory levels normalize” and higher prices kick in, the firm said.
IDC estimates that shipments from Apple jumped 14% in the first quarter from a year earlier, while ASUS shipments rose more than 11%. Shipments from Lenovo and HP — the top two PC makers — grew about 11% and 6%, respectively.
— CNBC’s Kif Leswing contributed to this report
Technology
Apple, Nvidia soar more than 10% as tech stocks rally after Trump postpones some tariffs for 90 days
-
Sports2 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports1 year agoStory injured on diving stop, exits Red Sox game
-
Sports1 year agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports4 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment2 years agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Business3 years agoBank of England’s extraordinary response to government policy is almost unthinkable | Ed Conway