Former member of the European Parliament Sophie in ´t Veld published her letter to the Commission and European Data Protection Authorities on transatlantic data flows. From the letter:

However, there is one area where the European Union is conspicuously silent: the impact of Trump policies on transatlantic data transfers. The EU and the US are deeply intertwined in this area and the volume of transatlantic data flows is massive. Data sharing across the Atlantic for commercial and law enforcement purposes has always been a delicate issue, not to say controversial, as in many cases it does not comply with EU standards on fundamental rights, including data protection and legal redress. Several rulings by the EU Court of Justice have confirmed the inadequacy of the protections agreed between the EU and the US. It is regrettable that the European Commission has so far taken little to no action to address the issue. (…)

Yet, so far there has been no visible action from the European Union, leaving EU citizens and residents unprotected and creating massive security risks.

There are risks associated with the agreements with the US that have long been known and accepted at the time:

These systemic weaknesses and risks did not arise in recent weeks, they have been known for many years. The US has often arm-twisted the EU into accepting data transfers without adequate protection. For example by threatening to withhold landing rights to air carriers (Re PNR data), or operating licenses for banks (FATCA data) or exclusion from the US Visa Waiver Programme (giving US authorities access to various data). The EU has always meekly accepted this and gave precedence to diplomatic relations over the rights of its own citizens. It is clear that this is no longer possible in the current circumstances.

She calls for action regarding several agreements between the US and EU / EU-countries:

• The 2016 Umbrella Agreement (“Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offenses”)
• The 2023 adequacy decision for the Transatlantic Data Privacy Framework (TADPF)
• The 2012 EU – US agreement on Passenger Name Records (PNR)
• The 2010 SWIFT agreement (“Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for purposes of the Terrorist Finance Tracking Program”)
• Member states – US Intergovernmental Agreements for the implementation of the US anti-tax evasion act FATCA
• EU – US negotiations on access to electronic evidence and the US CLOUD Act

Her comment on the consequences for FATCA:

5. For the purpose of the implementation of te US FATCA act, tax data of EU citizens are being shared by banks with the US authorities on the basis of bilateral US – EU member state intergovernmental agreements (IGA). This arrangement has been ruled legally flawed on several occasions by European Data Protection Authorities, but that has not prevented the data flows. However, as the Trump administration wants its new DOGE department to have access to data bases of the US Internal Revenue Service, it is clear that even the inadequate conditions of the IGA are no longer met, and thus fully illegal.

In’t Veld asks the following questions:

1. Do you agree that in the current circumstances the existing arrangements for transatlantic data transfers for both commercial and law enforcement purposes are inadequate, in many cases unlawful, and that they pose grave risks for citizens’ rights and European security?
2. Have you analyzed the situation and if so, will you make the results public?
3. What immediate action will you take to address the risks described above? Please specify for each of the six areas mentioned.

How will the EU respond?

My earlier article on this subject: Geen vuiltje aan de lucht bij transfers van persoonsgegevens naar de VS and other articles on this site on data protection in the US.