META Meta Platforms Inc

BRUSSELS—European Union privacy regulators on Tuesday gave the new EU-U.S. data-transfer deal their blessing despite some lingering concerns, providing companies with more certainty though legal challenges from privacy activists are likely.

The U.S. and the European Commission, the bloc's executive arm, finalized the so-called Privacy Shield in mid-July, following months of talks over the mechanism's technical details since it was first announced in February.

The commission said it incorporated advice from the bloc's national data-protection authorities and the European Parliament in its final decision to ensure that Europeans' data is adequately protected from American surveillance when moved to U.S.-based servers.

On Tuesday, the head of the EU's regulators said the finalized framework showed real improvements from the draft version and that the data-protection authorities wouldn't challenge the new framework in court on their own initiative.

"On several points, the final decision answers to what we asked for, both on the commercial side and on the public-security side," said Isabelle Falque-Pierrotin, head of France's data-protection authority and chairwoman of the pan-EU group.

The body representing the EU's national data-protection authorities had warned in April it could challenge the Privacy Shield in court unless both sides provided more clarity about bulk collection of data by national-security services and other issues.

The Privacy Shield replaces a previous mechanism, known as Safe Harbor, which was struck down by the European Court of Justice on concerns of mass surveillance by the U.S. The decision unleashed uncertainty for thousands of companies relying on it to legally send all types of business information, such as customer databases, across the Atlantic.

While the new data-transfer framework will likely also be tested in court by privacy activists demanding stricter controls about access to data by U.S. intelligence services, the green light from the privacy regulators for the new deal mitigates any uncertainty for businesses planning to sign up.

Still, Ms. Pierrotin said the data-protection regulators had some lingering concerns they hoped would be addressed in the first annual review next summer. Under the new mechanism, authorities in the U.S. and Europe will review the data-transfer framework every year to ensure the smooth functioning of the Privacy Shield.

Ms. Pierrotin said, at that review, the privacy regulators want to see evidence that the additional commitments by the U.S. over limits to accessing Europeans data for security reasons are effective.

She also suggested possible changes to U.S. legislation, such as allowing the ombudswoman—currently Under Secretary of State Catherine Novelli—to go before a judge if she is dissatisfied with information provided by the oversight bodies. Under the Privacy Shield, Ms. Novelli will be tasked with fielding and investigating complaints from Europeans about U.S. surveillance practices.

While privacy regulators will give the Privacy Shield a chance to get up and running, court decisions coming up before the annual review could impact the regulatory landscape, Ms. Pierrotin said.

In late May, the Irish Data Protection Commissioner's office said it wanted the European Court of Justice, the EU's highest court, to review backup contractual language that Facebook Inc. and thousands of other companies use to justify sending personal information about Europeans to the U.S.

Following last year's court decision, many companies are now relying on contracts using those so-called standard contractual clauses to authorize their data transfers.

The new measures secured for the Privacy Shield, such as oversight from the ombudswoman as well as safeguards about limits to access by national security services, also apply to those other methods.

A negative court decision in the case over standardized contracts could signify the Privacy Shield might also not pass a test in court.

Companies can sign up to the Privacy Shield starting Aug. 1.

Write to Natalia Drozdiak at natalia.drozdiak@wsj.com

(END) Dow Jones Newswires

July 26, 2016 08:35 ET (12:35 GMT)

Copyright (c) 2016 Dow Jones & Company, Inc.