On October 7, 2022, President Biden signed an Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities,1 which is intended to implement U.S. commitments under the Trans-Atlantic Data Privacy Framework (DPF) announced in March 2022. With the new executive order, the Biden administration aims to strengthen the legal foundation for trans-Atlantic data flows following the 2020 Schrems II decision in which the Court of Justice of the European Union (CJEU) struck down the European Commission’s adequacy decision underlying the EU-U.S. Privacy Shield framework self-certification scheme. The executive order creates additional privacy and civil liberties safeguards for U.S. signals intelligence collection activities, as well as a new “Signals Intelligence Redress Mechanism,” which includes a new “Data Protection Review Court.” The European Commission is next expected to prepare a draft adequacy decision to adopt the DPF as a valid transfer mechanism for transfers of personal data from the European Union to the United States.
This Legal Update summarizes the key developments under the executive order, what will come next from the EU, and alternative bases for EU-U.S. data transfers while the EU evaluates the DPF as implemented through the executive order.