EU-US Personal Data flows in crisis: How to move forward?

The article focuses on the ongoing crisis and legal challenges surrounding transatlantic personal data flows between the European Union (EU) and the United States (US), particularly in light of differing approaches to data privacy and national security exceptions. It traces the evolution of EU-US data transfer frameworks, including the invalidation of the Safe Harbour and Privacy Shield adequacy decisions by the Court of Justice of the European Union (CJEU) due to concerns over US mass surveillance practices and insufficient safeguards for EU citizens' data. The article highlights that while the US emphasizes economic and intelligence uses of personal data with fragmented state-level privacy laws, the EU treats personal data protection as a fundamental right, applying strict regulatory frameworks like the General Data Protection Regulation (GDPR). It also discusses the national security exceptions in both jurisdictions, noting that EU Member States engage in similar bulk data collection practices as the US, leading to complex legal and political tensions. The recent Trans-Atlantic Data Privacy Framework (DPF) aims to address these issues, but questions remain about its adequacy and whether it will withstand future judicial scrutiny. The article concludes that harmonizing national security data practices within the EU and aligning intra- and extra-EU case law could improve transatlantic data sharing, while also suggesting that multilateral forums like the OECD might offer a more democratic path for establishing global data protection standards.