SAP SAP SE

BRUSSELS—Firms will be able to sign up as soon as August to a new trans-Atlantic data-transfer framework that will make it easier to move personal information from Europe to the U.S. after the European Union rubber-stamped the mechanism on Tuesday.

The EU and U.S. have been tweaking the framework, known as the Privacy Shield, since it was unveiled in February to ensure it guarantees strict levels of protection for Europeans' data when companies move that information to servers in the U.S.

Washington and Brussels want to avoid the fate suffered by the previous mechanism, known as Safe Harbor, which was overturned by the European Court of Justice on concerns over mass surveillance by the U.S. That court decision spawned uncertainty for thousands of companies relying on the method to conduct basic business operations like transferring payroll information or social media profiles to American soil.

"With new privacy protections in place, we are confident the framework will withstand further scrutiny," said U.S. Commerce Secretary Penny Pritzker.

Negotiations between the U.S. and the EU concluded in late June, after Washington provided more clarity about the circumstances in which it collects bulk amounts of data for national security purposes and pledged this wasn't a form of mass surveillance.

In an additional letter submitted in June as part of the official Privacy Shield document, the U.S. Office of the Director of National Intelligence vowed that security services only collect bulk amounts of data in situations where they can't specify the target. One example is when the intelligence community doesn't know the names or phone numbers of members of a terrorist group operating in the Middle East who may be plotting attacks against Western European countries, the ODNI said.

"We might choose to target that group by collecting communications to and from that region for further review and analysis," ODNI General Counsel Robert Litt wrote in the letter.

The EU and U.S. have also pledged that the new ombudsperson, who will be tasked with fielding and investigating complaints from Europeans about U.S. surveillance practices, will be completely independent from the intelligence community and report directly to the U.S. Secretary of State.

In addition, companies will have to abide by stricter rules around how they process data and how long they hold on to it.

Under the new system, commerce and data-protection authorities in the U.S. and EU will review the mechanism every year to ensure operations continue to run smoothly. The U.S. has also promised to brief the commission on any legal changes that could affect the Privacy Shield, the EU said.

"The Privacy Shield will strengthen the trans-Atlantic economy and reaffirms our shared values," said EU Justice Commissioner Vera Jourova, whose portfolio made her the lead negotiator on behalf of the EU for the deal. "Our attention must now turn to getting the Privacy Shield up and running in practice."

Companies will be able to sign up to the Privacy Shield from Aug. 1 once they have implemented any necessary changes to comply with the stricter rules.

Firms have other methods, such as model contracts, to transfer data but these are more cumbersome. The new measures secured for the Privacy Shield, such as redress possibilities for EU citizens, will also apply to those other methods, the EU said.

Some lawmakers and privacy activists have expressed skepticism the new mechanism will hold up in court where it will inevitably be challenged.

"I am not convinced that this is Schrems-proof—I am convinced, however that Mr. Schrems or someone like him will go to court," Dutch lawmaker Sophie In 't Veld said in the European Parliament on Monday, referring to Austrian privacy activist Max Schrems, whose complaint was behind the court ruling that struck down Safe Harbor.

But some companies, including Microsoft Inc., are convinced the Privacy Shield will pass legal muster and are eager to sign up right away.

The previous data-transfer scheme "fell short of what European data-protection rules required, and I believe the Privacy Shield now meets each of those requirements," said John Frank, Microsoft's vice president for EU government affairs.

Digital Europe spokesman Paul Meller said the association's members, which include Apple Inc. and German business software provider SAP SE, would likely follow suit and sign up to the Privacy Shield.

Write to Natalia Drozdiak at natalia.drozdiak@wsj.com

(END) Dow Jones Newswires

July 12, 2016 08:15 ET (12:15 GMT)

Copyright (c) 2016 Dow Jones & Company, Inc.