Following the announcement of US President Donald Trump's new initiatives on the Privacy Act (the US law on the protection of personal information), the European Commission said Friday 27 January that it will be "very vigilant".
Two days earlier, Trump signed an executive order limiting the protection provided by the Privacy Act to US citizens and casting doubt on the progress on data protection made thus far, under the Obama administration, in favour of Europeans – namely Privacy Shield, the replacement for Safe Harbour, or the transatlantic agreement on personal data.
European Commissioner for Justice, Consumers and Gender Equality Vera Jourova, who is responsible for this issue, promised in Malta that the Commission will remain vigilant and she repeated her wish to meet her US counterparts in Washington in late March or early April. "We need reconfirmation that Privacy Shield can remain in place", she said, also announcing the Commission's first report on this subject for September.
The initial reaction from the Commission during the evening of Thursday 26 January was more nuanced, stating that Trump's executive order should not theoretically affect the agreements negotiated over recent years with the Obama administration. "We are aware of the executive order on public security. The US law on personal information protection (Privacy Act) has never offered data protection rights to Europeans. The Commission has negotiated two additional instruments to ensure that EU citizens' data are duly protected when transferred to the US", the Commission stated on Thursday evening.
Privacy Shield, the instrument that oversees the transfer of personal data to the US in a trade context (via Google, Facebook or other applications), is not based on the "protection provided for" by the Privacy Act, the Commission commented after analysis.
The transatlantic agreement on personal data, however, which will enter into force in February, depends partly on a new law adopted by the US Congress in 2016 – the Judicial Redress Act, which extends the protection of the Privacy Act to Europeans by giving them the right of appeal on US soil – and could be directly affected by Trump's decisions.
Nevertheless, an executive order cannot theoretically annul a law that has already been approved by Congress. For this to happen, Congress would need to annul the law itself, a Commission source told EUROPE. (Original version in French by Solenn Paulic)