Understanding the Evolution of Transatlantic Data Privacy Regimes: Ideas, Interests, and Institutions

Transatlantic data flows are critical to the European Union–United States (US–EU) economic relationship. In a digitalised world, data are not only an economic resource but also important for protecting personal privacy, human rights, and national security interests. Nevertheless, the current transatlantic data privacy regimes are somewhat fragmented, and there is a lack of a coherent regulatory approach to data collection, storage, and transfer. In 2020, the Court of Justice of the European Union (CJEU) found that the US and EU data transfer accords failed to meet EU data protection standards and breached the US–EU Privacy Shield framework. The CJEU's 2020 invalidation of the Privacy Shield has limited transatlantic data flows and led to a lengthy period of persistent uncertainty for EU and US businesses. On July 10, 2023, the European Union adopted its adequacy decision for the EU-US Data Privacy Framework (DPF), which seeks to facilitate cross-border transfers of personal data in compliance with EU law. Against this backdrop, this research seeks to unpack and explain the turbulent process of institutionalisation of US-EU engagement in data privacy. By adopting an interests, ideas, and institutions (3I) approach, this article examines the key differences between the EU and US approaches to data governance as well as explains the facilitating and constraining factors underlying the EU–US relationship in terms of data flow and privacy regulation.