The statement says that
The new Framework marks an unprecedented commitment on the U.S. side to implement reforms that will strengthen the privacy and civil liberties protections applicable to U.S. signals intelligence activities.
That at least claims to be a restriction on surveillance, not an increase in authorization for surveillance. The statement also says that the US will:
establish a two-level independent redress mechanism with binding authority to direct remedial measures, and enhance rigorous and layered oversight of signals intelligence activities to ensure compliance with limitations on surveillance activities.
That seem to be rather different from allowing surveillance on a "whim".
Until the details of this new "framework" are published one cannot judge how effective these measures are likely to be, they might be mere lip service. But let us look at the reason behind them. Since the Schrems II decision, EU entities have, in many cases, been restricted from sharing data with US entities, or storing data on US-located servers, because of a concern that current US law did not sufficiently protect the privacy of EU residents. These restrictions have been a problem for many US businesses.
It seems that this new framework is aimed at giving enough privacy protection to lower these restrictions. It will be up to the EC and the European Courts to judge if the framework achieves that goal. If they decide that it does not, they can decline to lower, or reimpose, the data transfer restrictions, which would make the framework pointless for the US. It is in the US's interest to keep the EU authorities satisfied on this point.
In the article "United States and European Commission Announce Trans-Atlantic Data Privacy Framework: Setting the Scene for Schrems III?" from the National Law Review it is states that:
The success or failure of the new agreement will depend on the extent to which it overcomes the flaws identified by the ECJ in Schrems II. The ECJ ruled against the EU Commission’s adequacy decision in favour of Privacy Shield, finding that data subjects were inadequately protected against electronic surveillance or “signals intelligence” activities carried out under US Federal authority, and that data subjects impacted by such activities had no viable route to redress.
...
It is important to remember that Schrems II did not strike down Privacy Shield, which has continued to operate since July 2020. Rather, the European Court of Justice ruling struck down the EU Commission’s adequacy decision in favour of Privacy Shield. Consequently, a key objective of the new Trans-Atlantic Data Privacy Framework is not to replace Privacy Shield, but to revive and enhance it with new mechanisms to address the flaws identified in Schrems II.
Participating companies and organizations that take advantage of the Framework to legally protect data flows will continue to be required to adhere to the Privacy Shield Principles, including the requirement to self-certify their adherence to the Principles through the U.S. Department of Commerce.
The language of the White House fact sheet suggests some areas likely to attract close scrutiny once the full details are available:
What degree of impact on individual data subjects will be considered acceptable, and in what circumstances? The US government is not promising to refrain from the use of signals intelligence and electronic surveillance. It is promising only that intelligence activity will be limited to “legitimate national security interests” and that the impact on individuals will not be “disproportionate”.
How far the composition of the proposed Data Protection Review Court will ensure that it is truly independent of the Federal government?
According to this NY Times story:
The deal includes a way for Europeans to object if they feel that their privacy has been violated, including through an “independent Data Protection Review Court,” the White House said in a fact sheet released after the news conference. The deal still needs to be made final, the United States and the European Commission said in a joint statement, adding that the White House would put its commitments in an executive order.
Businesses that send European Union data to American servers have pushed hard for the governments to reach a new deal. Since the last pact was struck down more than 18 months ago, regulators in European countries have said companies cannot use certain web services, like Google Analytics and Mailchimp, because doing so could violate the privacy rights of Europeans.
Meta, the parent company of Facebook, said this year that it might shut down its services in Europe if the governments didn’t resolve their differences. Google’s top lawyer had urged “quick action to restore a practical framework that both protects privacy and promotes prosperity.”
The Friday announcement is the latest development in a lengthy debate about how far governments and tech companies should go to protect users’ privacy. Europe’s top court twice struck down pacts governing data flows between the United States and the European Union over concerns that the data would be exposed to American surveillance programs.
All of this is based on the joint announcement by the US and the EC, with detailed documents apparently yet to come.
