The German Interior Ministry has expressed concerns about the future of the data transfer agreement between the EU and US after the Republican administration of President Donald Trump vowed to review, and possibly repeal, all the decrees signed by his predecessor.
The current agreement, known as the EU-US Data Privacy Framework and used by businesses on both side of the Atlantic for data transfers, is based on commitments made by the US administration led by Democrat Joe Biden, which were set out in an executive order. There are now fears that Trump could lift the legal basis for the agreement.
The German ministry told newspaper Handelsblatt that “legally secure” data transfers are of “great importance” for the German economy. Many businesses depend on cloud storage from the US for example, with Amazon Web Services, Microsoft and Google as dominant services.
The concerns of the ministry were echoed by privacy group NOYB, which told Euronews that the European Commission “has always relied on a mosaic-puzzle approach” which when pieced together is sufficient to prove adequacy when drafting the agreement with the US.
It adds that companies are “thinking massively about hosting in Europe and finding alternatives.”
In 2023, the European Commission adopted the EU-US Data Privacy Framework which acknowledges that data transfers between the EU and US can be considered safe.
Two months later the deal was challenged before the European Court of Justice (ECJ) by French politician Philippe Latombe. The case was heard earlier this month and a ruling will follow at a later stage.
It came after the previous data transfer agreements, Privacy Shield and Safe Harbor, were declared invalid by the ECJ, because US national privacy laws were deemed to lack sufficient safeguards to limit the access to personal data by national security authorities.
In the absence of an adequacy decision, businesses can use alternative data transfer mechanisms such as standard contractual clauses (SCCs), which need a review by the national data protection authorities and are therefore often lengthy processes.
The Commission will review the agreement periodically. According to the legal text, when the EU executive has “indications that an adequate level of protection is no longer ensured”, it will inform the US authorities, if necessary it can suspend, amend or repeal the decision.
