The key question is where do we go from here. The EU and the U.S. have pledged to work together on a successor to Privacy Shield. Workday strongly supports these efforts: it’s vital that policymakers on both sides of the Atlantic work together in good faith to come up with a framework that works for both. Attempts to put pressure on one side or the other, or to use trade enforcement mechanisms, will only lead to the hardening of positions and delays.
What a successor agreement looks like—in light of the CJEU’s concerns—is hard to say at this point. Ultimately, any new agreement will be the product of successful EU-U.S. negotiations. As part of that effort, a number of potential steps could be taken to narrow the gap between the CJEU decision and U.S. practice. For example, the ombudsperson established by Privacy Shield to hear complaints about unnecessary access to data could be given greater independence, just as we in the U.S. have independent agencies across the government. The ombudsperson’s findings regarding protection of individual’s rights similarly could be made binding. Existing administrative protections regarding use of data could be codified. Requirements around use of encryption for data in transit could be strengthened. Treating some categories of personal data differently—those that are unlikely to be of interest to the government—could be helpful. Ultimately, some combination of these or other measures and protections could provide a path forward to a lasting, sustainable mechanism for data transfers from the EU to the U.S.
According to McKinsey, cross-border data flows accounted for $2.8 trillion in global GDP in 2014, and their importance has only increased since then. Likewise, as the European Commission notes, total U.S. investment in the EU is three times that of U.S. investment in Asia, and EU investment in the U.S. is eight times EU investment in India and China combined. In an increasingly digital world, continued cross-border data flows are essential to our close economic relationship. For this reason, a stable long-term solution is vital.