Biden signs an EO to implement Privacy Shield 2.0, the EU-US data transfer framework seeking to address EU concerns of surveillance by US intelligence agencies
- President Joe Biden signed an executive order to implement a new framework to protect the privacy of personal data shared between the U.S. and Europe.
CNBCLauren Feiner
Context & Ripple Effects
The executive order revisits the original Privacy Shield architecture, which the EU approved in 2016 after negotiators added stricter transfer rules and new surveillance limits and opened the framework to participating firms. The new U.S. action matters because the arrangement depends on U.S. privacy and intelligence-surveillance commitments, not solely on company contracts.
Related coverage later records another EU-U.S. data-transfer agreement facing a potential legal challenge after EU judges had rejected two earlier pacts, underscoring that a framework’s durability hinges on whether its surveillance safeguards satisfy European privacy standards.
First-order effects
The U.S. government moves Privacy Shield 2.0 from a negotiated framework toward implementation, giving EU-U.S. data transfers a new policy basis intended to address European surveillance concerns.
Firms seeking to use the framework gain a prospective alternative to managing transatlantic personal-data transfers solely through their own arrangements.
Second-order effects
EU institutions must assess whether the U.S. safeguards embedded in the executive order are sufficient for a durable transfer mechanism, making surveillance oversight central to the framework’s practical value.
Companies transferring European personal data face continued compliance uncertainty until the new framework proves resilient to the same privacy objections that shaped the earlier EU-approved Privacy Shield regime.
Third-order effects
The repeated redesign of EU-U.S. transfer rules points to cross-border data flows becoming governed less by commercial interoperability alone and more by whether national-security access can meet foreign privacy standards.
If legal scrutiny continues to unsettle successive pacts, companies will have stronger incentives to design data operations around jurisdictional and access-control boundaries rather than a single transatlantic framework.
The trend: Cross-border data-transfer policy is increasingly tying access to global digital markets to enforceable limits on government surveillance.
This is the line in the @WhiteHouse executive order on transatlantic data transfers you really should be focusing on. Big win for Washington, imo HT: @vmanancourt @alfredwkng https://twitter.com/...
Now free to read: https://www.politico.eu/... “The move marks a win for the U.S. government, which has long griped that Brussels holds all the cards in data flows talks and that its national security laws are held to a higher standard than even the EU's own.” https://twitter.com/…
Today, @POTUS signed an Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, a key step that ensures a stable and reliable basis for transatlantic data flows and underscores the strength of the U.S.-EU relationship. https://www.whitehouse.gov…
Use of the word ‘proportionate’ in Sec. 2(B) is a big deal. This gets to human rights standards, which call for surveillance to be both necessary and proportionate. Looks like the balance is to be struck between the intelligence priority and the privacy impact
Nicely put: The new EO defines the wording of your “judgment” by this “court” before you even file a complaint... 😂 https://twitter.com/... https://twitter.com/...
However, earlier it says that surveillance will continue to follow current law, which provides a basis for activities based on foreigness without needing to show that the target is engaging in (or suspected to be engaging in) unlawful activity
One thing I am really unhappy with is the continued recognition only of privacy interests - they stepped back from actually talking about privacy rights of all people. Missed opportunity.
Big picture- will this be enough? I think it's a significant amount more than what we've seen before and should be recognized as a huge step. Meaningful limits and redress, but no changes in law, still allows for bulk collection, and broad surveillance purposes.
We welcome signature of Executive Order to implement US commitments under EU-US Data Privacy Framework. @EU_Commission will now work to issue an #AdequacyDecision to protect privacy and facilitate safe transatlantic data flows. More here: https://ec.europa.eu/... #DataProtection …
We understand and appreciate that the Biden Administration is trying to do by executive order some of what is required by international law and the EU. But an executive order isn't enough. https://www.whitehouse.gov/...
As we've been explaining for a decade now, the reason the EU/US data privacy framework keeps falling apart is that the NSA can't stop spying on everyone. And now the US's response is “dude, trust us, we'll be good.” Not sure that will fly. https://twitter.com/... https://twitter.…
We welcome this #ExecutiveOrder and appreciate the efforts of USG and @EU_Commission to protect people's data on both sides of the Atlantic. While we're still assessing the details of these reforms, today's announcement is a crucial step forward. #DPF https://www.whitehouse.gov/.…
My statement regarding the signing today by @POTUS of an Executive Order on “Enhancing Safeguards for United States Signals Intelligence Activities”: https://www.commerce.gov/...