Summary:

The European Union and the US have settled on a new transatlantic data-sharing pact.

The decision comes three years after the EU’s top court struck down the Privacy Shield, a protocol that let companies based in the US collect and process data from EU citizens. At the time, the court said the Privacy Shield didn’t do enough to keep users’ data out of the hands of US intelligence agencies.

The new EU-US Data Privacy Framework should protect companies from facing similar penalties so long as they commit to it. In addition to limiting the amount of overseas data that US intelligence can gain access to, the new framework establishes a Data Protection Review Court (DPRC) that can “independently investigate and resolve complaints” as well as order the deletion of data.

Going forward, it’s not clear whether this policy will stand up to the EU’s court, as two previous attempts to establish a new framework were thrown out by judges.