EU-US personal data flows in crisis: how to move forward?

The ‘national security exception’. An ambiguous concept between the good and the bad. The State has a duty to protect its citizens and to prevent horrible situations, such as terrorist attacks, from occurring. George Orwell’s 1984 shows, however, a darker side where the surveillance State is watching its citizens’ every move and thought. How far can the State go? And how does the State try to strike a balance with citizens’ rights? The case of the US and the EU in the context of personal data protection sheds some light on how these conflicting interests can be balanced. Both sides of the Atlantic make use of the national security exception, each within its own historical, cultural, sociological and legal context. Misunderstandings might occur at first sight, but a deeper analysis can reveal the complexities of each system and interesting similarities. To that end, Section 1 starts with an introduction to personal data collection and the US and EU approach to data privacy, showing that the national security exception is relevant for each one of us. Section 2 provides an overview of the EU-US personal data transfer frameworks together with an explanation of their invalidation, focusing on the national security exception. Section 3 explains the national security exception as applied in the US and the EU, followed by discussion and analysis in Section 4. Section 5 concludes this paper by bringing all the discussed topics together.