EU and U.S. agree to new data-sharing pact, offering some respite for Big Tech

The European Union and the U.S. on Friday announced they had agreed "in principle" to a new framework for cross-border data transfers, providing some much-needed relief for tech giants like Meta and Google.

For over a year, officials on either side of the Atlantic have been hashing out a deal to replace the so-called Privacy Shield, an arrangement allowing firms to share Europeans' data to the U.S.

Privacy Shield was invalidated in July 2020, striking a blow to Facebook and other companies that had relied on the mechanism for their EU-U.S. data flows. The EU's top court sided with Max Schrems, an Austrian privacy activist who argued the existing framework did not protect Europeans from U.S. surveillance.

The new agreement will "enable predictable and trustworthy data flows between the EU and US, safeguarding privacy and civil liberties," European Commission President Ursula von der Leyen said Friday, without offering much additional detail on how it will work.

News of the agreement will offer some respite for Meta and a slew of other firms which have faced legal uncertainty over how they move data across borders in the wake of the decision to scrap Privacy Shield. Meta had suggested it may even have to shut down Facebook and Instagram in Europe over the issue.

Meta wasn't immediately available for comment on the deal.

"People want to be able to use digital services from anywhere in the world and know that their information is safe and protected when they communicate across borders," Kent Walker, Google's president of global affairs, told CNBC.

"We commend the work done by the European Commission and U.S. government to agree on a new EU-U.S. framework and safeguard transatlantic data transfers."

However, Guillaume Couneson, a data protection partner at law firm Linklaters, warned it was too early to say whether the new agreement stands the test of time. Privacy Shield itself was the replacement for Safe Harbor, an earlier EU-U.S. data pact.

"This new solution will have to withstand the scrutiny of the supervisory authorities and the privacy activists that brought down the two previous ones," Couneson said.

Schrems, who was instrumental in bringing down both the Privacy Shield and Safe Harbor, said the "final text" of the new agreement would take more time to come through. But, he added he's prepared to challenge it "if it is not in line with EU law."

"In the end, the [EU] Court of Justice will decide a third time. We expect this to be back at the Court within months from a final decision," Schrems said in a statement.

The deal was announced alongside a separate agreement with the U.S. to provide energy to Europe as the Russian invasion of Ukraine threatens to disrupt the continent's energy supplies.