U.S.-EU Privacy Shield: Trump Executive Order Puts Privacy Agreement In Jeopardy

An executive order issued by President Donald Trump on Wednesday may invalidate an agreement between the United States and the European Union designed to ensure the privacy of user data transferred by Europeans to companies in the U.S.

The U.S.-EU Privacy Shield agreement is a six-month old authorization framework that took years of negotiation under the Barack Obama administration to put in place. Under the terms of the Privacy Shield, U.S.-based companies can receive personal data from entities in the European Union—including but not limited to citizens—as long as they adhere to the same privacy laws applicable in the EU.

More than 1,500 companies including Apple, Google and Microsoft all agreed to abide by the agreement, are were required to comply by the U.S. Department of Commerce.

That agreement is now in jeopardy following Trump’s executive order that purports to be about “Enhancing Public Safety in the Interior of the United States.” While the majority of the order dealt with immigration laws, a portion of the action also puts the Privacy Shield at risk.

“Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information,” the order reads.

While the action may not have been specifically targeting the agreement with the EU, it very well may apply to it by excluding “persons who are not United States citizens or lawful permanent residents.” The phrase would apply to European citizens whose data is traveling across the Atlantic.

The executive order puts the U.S. at risk of being sanctioned by the EU for violating its privacy laws and could lead to the suspension of the agreement entirely—a possibility that would be especially troubling for tech companies based in the U.S. who do business overseas.

At the Computers, Privacy and Data Protection Conference in Brussels this week, the European Commission warned, “if adequacy is no longer guaranteed, we will have to suspend the Privacy Shield.”

Earlier this month, European Commissioner Vera Jourova said she planned to travel to the U.S. to meet with the Trump administration and assess its commitment to the Privacy Shield and ensure the government would continue its commitment to a “culture of privacy.”