EU and US come to ‘agreement in principle’ on data flows

The EU and US have reached an agreement in principle on facilitating data flows, including research data, across the Atlantic.

Steady data sharing has been hampered since the EU’s Court of Justice struck down the old rules due to concerns about US government surveillance in July 2020.

The future Trans-Atlantic Data Privacy Framework will introduce a new set of rules safeguarding Europeans data flowing across the Atlantic, which the Commission claims underpins “€900 billion in cross-border commerce every year.”

The new agreement, set to replace the Privacy Shield Framework killed off by the EU court, comes after more than a year of negotiations. It’s an agreement in principle and will now have to be translated into legal documents, to be adopted by both the EU and the US.

This time around, the hope is the framework won’t have any fatal flaws. “It is important to find a future proof solution, as we cannot fail a third time on this subject,” said Edit Herczog, member of the Research Data Alliance and former member of the European Parliament.

The data in question include research data shared by companies that take part in the EU framework research programmes, such as the results of clinical trials required to get approval of new drugs.

Kristina Irion, associate professor at the Institute for Information Law at the University of Amsterdam, says it is too early to make any assessments, but points out the agreement shows the US “has agreed to cave a bit” to EU demands on data privacy. “So far, it is a token of strength of the EU data protection framework,” she told Science|Business.

For the healthcare sector that relies on huge data flows globally to sustain its work, the agreement in principle promises legal certainty. Brendan Barnes, director for IP and data protection at the European Federation of Pharmaceutical Industries and Associations, says the initial reaction to the deal has been positive although it is too early to draw conclusions on its impact.

In the research intensive pharmaceutical industry, there are three types of data transfers that could be affected: research collaborations, data transferred to regulatory authorities and public health data.

“It’s very welcome that the two administrations are working to create some more legal certainty for data transfers from and to US and the EU,” said Barnes.

The current uncertainty around data transfers has had severe impacts on research collaborations, especially when US federal funding was involved, Barnes noted. A clear framework will bring certainty and could make European companies more attractive partners for global research projects.

“If you look at it very specifically in our sector, the type of issues that arise is that research is conducted globally, so our companies are looking for the best partners they can find globally. If there is a restriction, then that limits their choices and can limit their competitiveness,” said Barnes.

For universities, this will make it easier to get digital services for teaching, research and communication, such as Zoom and Microsoft 365, provided largely by US companies.

“When you then do a so-called personal data transfer impact assessment, this would actually say that because of the risk of surveillance, we cannot carry on using these kinds of services unless there are additional safeguards,” said Irion. “This will be remedied once we have the new agreement and it is actually implemented.”

This is only the beginning of big changes coming to the digital sector. Last week, EU policymakers reached a provisional agreement on the Digital Markets Act, set to limit the powers of big online platforms in a bid to make the digital sector fairer and more competitive.

As part of the new act, the Commission aims to guarantee high standards of data management, which could in the long run benefit researchers as they force companies to boost the quality and availability of data. Today, “in the age of supercomputing, researchers are still spending 80% of their time on data wrangling,” says Herczog. “Putting fair practices and FAIR [data] principles – findable, accessible, interoperable, and reusable – together has a potential step-change moment for research and innovation.”

In the next few months, Irion says universities are looking forward to the adoption of the Digital Service Act, the sister policy of the Digital Markets Act, which will include new transparency requirements for companies. “It will help us carry out research about misinformation, political influence from abroad, how negative information travels through social media,” said Irion.