	Introduction

On October 6, 2015, the Court of Justice of the European Union (CJEU) delivered a judgment that invalidated the Safe Harbor Agreement between the United States and the 28-member European Union (EU). U.S. and EU officials claim that Privacy Shield will contain significantly stronger privacy protections and oversight mechanisms, multiple redress possibilities, and new safeguards related to U.S. government access to personal data. Many U.S. officials and business leaders hope that the recently concluded (but not yet finalized) U.S.-EU Data Privacy and Protection Agreement (DPPA)—an "umbrella" accord aimed at better protecting personal information exchanged in a law enforcement context—and the newly enacted U.S. Judicial Redress Act ( H.R. 1428 / S. 1600 , P.L. 114-126 )—which extends the core of the judicial redress provisions in the U.S. Privacy Act of 1974 to EU citizens—could help ameliorate European concerns about U.S. data protection standards and bolster confidence in the newly proposed Privacy Shield Agreement. Data Privacy and Protection in the EU and the United States

Both the United States and EU assert that they are committed to upholding individual privacy rights and ensuring the protection of personal data, including electronic data. Nevertheless, data privacy and data protection issues have long been sticking points in U.S.-EU economic and security relations, in large part due to fundamental differences between the United States and EU in their approaches to data protection and data privacy laws. The U.S. As noted by U.S. They worried that these differences in approach could negatively affect many businesses and industries on both sides of the Atlantic, and potentially impact the U.S.-EU trade and investment relationship. Security. Access . Some 4,500 companies were on the Safe Harbor list. Notably, this included U.S. financial firms and telecommunications carriers. The New EU-U.S. Privacy Shield Agreement

U.S.-EU discussions on revising and updating the Safe Harbor Agreement began in late 2013 in response to growing European concerns about the NSA surveillance programs and subsequent allegations of other U.S. intelligence collection operations in Europe. The European Commission agreed, however, that there were a number of weaknesses in the Safe Harbor scheme. On February 2, 2016, two days after the January 31 deadline established by the Article 29 Working Group, U.S. and EU officials announced their agreement, "in principle," on a replacement to Safe Harbor—the EU-U.S. Privacy Shield, which if approved by the European Commission, would allow companies to continue to transfer EU citizen's personal data to the United States while complying with the requirements outlined by the CJEU when it declared Safe Harbor invalid in October 2015. On February 29, 2016, U.S. and EU officials released the full text of the agreement and supporting documentation. Many U.S. officials and industry leaders hope that recent Congressional efforts to provide a limited right of judicial redress to EU citizens—undertaken initially to help conclude a separate U.S.-EU umbrella accord for law enforcement, known as the Data Privacy and Protection Agreement (DPPA) —could help ease at least some European concerns about U.S. data protection standards and the new Privacy Shield agreement as well. Many U.S. officials and industry leaders view the Judicial Redress Act as a concrete indication of the U.S. commitment to addressing EU data protection concerns and hope that it will help boost confidence in U.S. data protection standards and the new Privacy Shield accord. As noted above, Safe Harbor was one of several mechanisms used as a legal basis for U.S.-EU data transfers. Issues for Congress

The CJEU's invalidation of Safe Harbor and the newly proposed EU-U.S. Privacy Shield Agreement raise issues for Members of Congress. U.S. Acceptability of Alternative Data Transfer Arrangements . Some analysts contend that the sweeping nature of the CJEU's decision could have implications for other U.S.-EU data-sharing arrangements, especially in the law enforcement field.
Both the United States and the European Union (EU) maintain that they are committed to upholding individual privacy rights and ensuring the protection of personal data. Nevertheless, data privacy and protection issues have long been sticking points in U.S.-EU economic and security relations, in part because of differences in U.S. and EU data privacy approaches and legal regimes. In the late 1990s, the United States and the EU negotiated the Safe Harbor Agreement of 2000 to allow U.S. companies and organizations to meet EU data protection requirements and permit the legal transfer of personal data between EU member countries and the United States.
The unauthorized disclosures in June 2013 of U.S. National Security Agency (NSA) surveillance programs and subsequent allegations of other U.S. intelligence activities in Europe renewed and exacerbated European concerns about U.S. data privacy and protection standards. The alleged involvement of some U.S. Internet and telecommunications companies in the NSA programs also elevated European worries about how U.S. technology firms use personal data and the extent of U.S. government access to such data. As a result, a number of U.S.-EU data-sharing accords in both the commercial and law enforcement sectors have come under intense scrutiny in Europe.
In October 2015, the Court of Justice of the European Union (CJEU, which is also known as the European Court of Justice, or ECJ) invalidated the Safe Harbor Agreement. The CJEU essentially found that Safe Harbor failed to meet EU data protection standards, in large part because of the U.S. surveillance programs. Given that some 4,500 U.S. companies were using Safe Harbor to legitimize transatlantic data transfers, U.S. officials and business leaders were deeply dismayed by the CJEU's ruling. Companies that had been using Safe Harbor as the legal basis for U.S.-EU data transfers were required to immediately implement alternative measures. Experts claimed that the CJEU decision created legal uncertainty for many U.S. companies and feared that it could negatively impact U.S.-EU trade and investment ties.
On February 2, 2016, U.S. and EU officials announced an agreement, "in principle," on a revised Safe Harbor accord, to be known as Privacy Shield; the full text of the agreement was released on February 29, 2016. U.S. and EU officials assert that the new accord will address the CJEU's concerns. In particular, they stress that it contains significantly stronger privacy protections as well as safeguards related to U.S. government access to personal data.
Some analysts question, however, whether Privacy Shield will sufficiently address the broader issues about the U.S. data protection framework raised by the CJEU decision, and thus be able to withstand future legal challenges. Many U.S. policymakers and trade groups hope that the recently concluded U.S.-EU "umbrella" Data Privacy and Protection Agreement (DPPA)—which seeks to better protect personal information exchanged in a law enforcement context—and the newly enacted U.S. Judicial Redress Act (H.R. 1428 / S. 1600, P.L. 114-126)—which extends the core of the judicial redress provisions in the U.S. Privacy Act of 1974 to EU citizens—could help ease at least some concerns about U.S. data protection standards and boost confidence in Privacy Shield.
This report provides background on U.S. and EU data protection policies and the Safe Harbor Agreement, discusses the CJEU ruling, and reviews the key elements of the newly-proposed Privacy Shield. It also explores various issues for Congress, including implications for U.S. firms of Safe Harbor's invalidation and the role of the Judicial Redress Act in helping to ameliorate U.S.-EU tensions on data privacy and protection issues.