European officials on Tuesday agreed to a deal with the United States that would let Google, Amazon and thousands of other businesses continue moving people’s digital data, including social media posts and financial information, back and forth across the Atlantic.  With billions of dollars of business potentially at stake, the data-transfer deal was the result of more than three months of often tense negotiations between United States and European Union policy makers, who have clashed over what level of privacy individuals can expect when companies and government agencies follow ever-expanding digital footprints.  Part of the challenge is balancing individuals’ privacy concerns with national security obligations, particularly in light of mounting fears about international terrorism.  The agreement announced on Tuesday aims to address those privacy concerns and strike that balance by including written guarantees by the United States — to be reviewed annually — that American intelligence agencies would not have indiscriminate access to Europeans’ digital data when it is sent across the Atlantic. Whether that provision will reassure privacy-rights groups remains to be seen.  All the talk about data privacy can get caught up in political wrangling. But the different approaches have practical consequences for people, too.  Many obstacles still await the deal, which must be officially approved by the European Union’s 28 member states. National data protection regulators have yet to give their support to the pact, and European privacy-rights advocates are preparing to file legal challenges seeking to overturn it.  The data-transfer agreement, replacing a 15-year-old pact that Europe’s highest court struck down in October, is intended to let the free flow of digital data — the lifeblood of many global businesses — continue as usual.  In seeking to ensure the continued free flow of digital data, the deal announced on Tuesday could especially benefit big American companies like Google, Facebook and Amazon that tend to dominate Internet searches, social media and digital commerce in Europe. But it is also meant to let nontech companies like the drugmaker Pfizer and the industrial conglomerate General Electric continue to send customer and employee data between the United States and Europe.  Europe’s privacy watchdogs had demanded that European and American officials agree to a new deal by Jan. 31. Although negotiators missed that deadline, they had been meeting almost continuously in Brussels since Sunday to hammer out an agreement. They were driven by a sense of urgency, as industry executives and trade bodies on both sides of the Atlantic worried that the means for transferring data between two of the world’s largest economies remained in jeopardy.  Most sensitive, perhaps, were provisions demanded by the European Commission, the executive arm of the European Union, aimed at limiting how American intelligence agencies collect data on Europeans when companies send their personal information to the United States.  The American negotiators, in response, agreed to provide the annual written assurances.  These guarantees, European officials said, will be reviewed each year, with American and European policy makers meeting to ensure that the strict privacy rights of Europe’s more than 500 million citizens are respected by United States agencies.  “We will hold the U.S. accountable on the commitments that they have made,” Vera Jourova, the European Union’s justice commissioner who has led the negotiating team, said on Tuesday.  A spokeswoman for the Commerce Department, which led the American negotiations, said the department would hold a separate news conference in Washington on Tuesday to discuss the agreement.  Both sides will now spend the next two weeks completing the details of the new pact, which is to be called the E.U.-U.S. Privacy Shield. If formally approved, it would go into effect by early April.  But the deal’s first hurdle comes on Wednesday, when Europe’s increasingly powerful national privacy agencies plan to pass their own judgment on how data can be safely transferred outside the European Union  Many of these agencies, which can investigate and issue fines to companies that they suspect of misusing people’s digital information, remain skeptical that rules protecting Europeans’ data will be upheld in the United States. And some of these monitors have said that they will support further restrictions on how companies can move the data if they suspect it may be misused.  “We are part of the game,” Isabelle Falque-Pierrotin, France’s privacy chief, said in an interview last month in Paris. “If you provide these services, then you have to protect people’s privacy rights.”  The biggest American tech companies face intensifying scrutiny by European regulators, with — pressure that could potentially curb their sizable profits in the region and affect how they operate around the world.  Ms. Falque-Pierrotin is the chairwoman of the Pan-European body that will announce its assessment on Wednesday.  The agreement drew praise on Tuesday from DigitalEurope, a group representing trade associations and multinational tech companies doing business in Europe, including Apple, Google and Microsoft.  John Higgins, the group’s director general, called in a statement for national privacy agencies “to view this signal from the European Commission as a sign of good faith and to hold off with any potential enforcement action until the new agreement has been fully implemented.”  Privacy groups, though, expressed concern that the data-transfer deal does not comply with European law, which views an individual’s right to privacy almost on par with freedom of expression.  Several consumer groups have said that they will file complaints with European privacy agencies to challenge the new agreement, while others have called on the United States to improve its own privacy laws to match those currently available in Europe.  “The problem is that the U.S. remains unchanged,” said Marc Rotenberg, president of the Electronic Privacy Information Center in Washington.  Despite these expected challenges, some European officials on Tuesday defended the new safe harbor agreement.  In particular, the European Commission highlighted how the United States had proposed greater oversight on the access American intelligence agencies have to Europeans’ data.  The United States also agreed to establish an ombudsman in the State Department to act as a first point of contact for Europeans if they believed American government agencies had misused their data.  Access granted to American intelligence agencies had become a sticking point in light of revelations by Edward J. Snowden, the former National Security Agency contractor, about that agency’s surveillance of foreign citizens.  During the most recent talks in Brussels, which involved officials from the United States Commerce Department and the Federal Trade Commission, among others, American negotiators had argued that United States law provided greater oversight and supervision of American intelligence agencies’ use of personal data than rules now in place across the European Union, according to several officials who spoke on the condition of anonymity because they were not authorized to speak publicly.  National security arguments had become more vehement following the terrorist attacks in Paris last November, those officials said. United States ambassadors had defended the integrity of oversight of American intelligence agencies in discussions with senior politicians in countries like France, Germany and Britain in recent weeks, according to the officials who asked to remain anonymous. .  But European Commission, which does not have the power to rule on its member states’ national security practices, had demanded written guarantees.  “This isn’t going to be a one-off decision by the commission,” said Ms. Jourova, the European justice commissioner. “We have achieved effective protection of Europeans’ rights.”
The agreement would let businesses like Google and Facebook continue to move personal data across the Atlantic, but European privacy officials may balk.