Cybersecurity Policy Report, ITIF Pushes U.S., EU to Resolve Data Privacy, Surveillance Issues, (Mar 26, 2021)

By Jeff Williams

Calling the situation "dire," the Information Technology and Innovation Foundation (ITIF) is urging the U.S. and European Union (EU) to take "swift action" to resolve their differences regarding data protection laws and U.S. surveillance policies or risk creating a "de facto data localization policy" that could result in millions of job losses and harm transatlantic trade.

ITIF made several recommendations it wants the U.S. and EU to adopt, including that they negotiate a new Privacy Shield to replace the U.S.-EU Privacy Shield that was invalidated last July (CPR, July 16, 2020).

The EU Court of Justice ruled that the Privacy Shield fell short of protecting the privacy of EU residents when their data was transferred between the EU and the U.S. The ruling upended one of the key legal mechanisms businesses had relied upon to enable transatlantic data flows.

"Long term, the two sides could work toward legislation and a treaty agreement that would codify some of their commitments," ITIF said in the report, which was released before an announcement by the U.S. and the EU of plans to "intensify" negotiations regarding an enhanced Privacy Shield framework (see separate story).

"In an ideal world, the United States and Europe would work together with like-minded countries to develop a 'Geneva Convention for Data,' which would create consensus on issues around government access to data," ITIF added.

EU policy-makers should not simply hope that the U.S. adopts rules that mirror the EU’s General Data Protection Regulation (GDPR), ITIF said.

Rather than the GDPR providing a "predictable and harmonized" data protection regime within the EU, the report argued "successive court challenges have made it harder and more complex—and without political intervention, the situation will devolve into an irrevocably severed transatlantic digital relationship."

It is unlikely any privacy bill enacted in the U.S. would address the underlying issues between the U.S. and EU, ITIF said.

"A comprehensive [U.S] data privacy bill would likely improve the context for transatlantic cooperation on digital issues, but cooperation would still need to be based on pragmatism and the need to build mechanisms for sharing between different regimes," ITIF said. "Policy-makers on both sides would be well-served to remain firmly rooted in this realization and the need to balance multiple interests and different data privacy and national security systems."

The EU should also "redouble efforts" to construct new data transfer mechanisms under the GDPR, as well as make existing legal tools, such as standard contractual clauses and binding corporate rules, "clear, reasonable, and accessible," ITIF said.

The EU and its members "need to reconcile privacy with their other interests instead of letting concerns about the former (largely driven by civil society advocates who privilege privacy concerns over almost everything else) outweigh the latter (as every country inevitably does in balancing human rights and economic, health, security, and other rights and interests)," the report said.

In addition, ITIF said, the U.S. and EU should complete negotiations to improve access to each other's electronic evidence for law enforcement investigations.

"A new agreement would improve law enforcement investigations while accounting for privacy and other concerns," ITIF said. "It would provide Internet service providers with a clear legal framework to manage requests, and remove a motivation that some policy-makers elsewhere around the world have used to try to justify data localization (in terms of facing issues with working through existing legal frameworks to access data stored overseas)."

ITIF also urged the U.S. and EU to "build a broader agenda for pragmatic cooperation on data and digital policy issues—one based on 'digital realpolitik.' Such cooperation would be economically beneficial to both sides given their extensive economic connections."

News: InternationalLegislation DataPrivacy