President Biden on Friday signed an executive order giving Europeans the ability to protest when they believe their personal information has been caught in America’s online surveillance dragnet, a key step toward reaching a broader agreement over the flow of digital data.
The order puts new restrictions on electronic surveillance by American intelligence agencies. In addition, Europeans will be able to complain to an official in the Office of the Director of National Intelligence if they believe their information was collected in a way that violated the standards or U.S. law. They could ultimately plead their case before a new independent review body, the Data Protection Review Court.
The announcement brings the United States and the European Union closer to a deal to let companies transfer digital data — like the information that powers Facebook’s service and informs Google about which sites people visit — across the Atlantic without running afoul of Europe’s privacy laws.
American companies say a deal is needed to allow their operations in Europe to continue and fuel economic activity. Privacy activists successfully sued to strike down two previous agreements, arguing they had failed to adequately protect Europeans from overreach by American intelligence agencies. Officials in Washington and Brussels have been intent on reaching a new deal since then.
A deal with the European Union will “enable the continued flow of data that underpins more than a trillion dollars in cross-border trade and investment every year,” Commerce Secretary Gina Raimondo said during a briefing with reporters on Thursday.
The executive order is the latest development in a debate that began when Edward Snowden, a former national security contractor, released details of how America’s foreign surveillance apparatus tapped into data stored by American tech and telecommunications companies.
After those revelations, a privacy activist went to a top European court claiming that Facebook’s storage of his data in the United States violated his rights. The court agreed, striking down a pact that allowed for the flow of data. The activist, Max Schrems, also successfully sued to invalidate the next iteration of the agreement — leaving officials in Washington and Brussels to reach the newest accord.
While they negotiated, several European privacy regulators ruled that American services, including Google Analytics and MailChimp, could violate Europeans’ privacy rights because they moved data through the United States.
Mr. Biden and the president of the European Commission, Ursula von der Leyen, announced in March that the two sides had reached an “agreement in principle.” Mr. Biden said at the time that the agreement would include “unprecedented protections for data privacy and security for our citizens.” It has taken months for the White House to issue the executive order.
Privacy activists could decide to sue to try to invalidate it again.
Mr. Schrems, the privacy activist, said his group “will analyze this package in detail, which will take a couple of days.”
“At first sight it seems that the core issues were not solved,” he said, adding that it appeared the issue would go back to the European courts “sooner or later.”
