There’s an agreement between the U.S. and the European Union – the Privacy Shield agreement - which allows the personal data of EU citizens to flow into the U.S. while maintaining the same protections as that data has in Europe. That pact could become invalidated by an executive order signed this week by President Trump.

The executive order excludes persons who are not U.S. citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information. Around 1,500 companies have been using the Privacy Shield framework to transfer data between the two regions.

It remains unclear just what impact the order will have, as the European Commission issued a statement Thursday saying the Privacy Act has “never offered data protection rights to Europeans” and that the Privacy Shield pact “does not rely on the protections of the U.S. Privacy Act.” The Commission statement said it’s negotiated “two additional instruments to ensure that EU citizens’ data is duly protected when transferred to the U.S.”

• But a member of the European Parliament, Jan Philipp Albrecht, put out a tweet Thursday saying if the order excludes non-U.S. citizens from Privacy Act protections, then the “EU Commission has to immediately suspend Privacy Shield” and “sanction the U.S. for breaking EU-U.S. umbrella agreement.”

• Aaron Tantleff of Foley & Lardner said it’s still unclear what the effect will be but it’s possible it will “call into question the ability of companies to operate.” He added that it could also put into jeopardy an umbrella agreement between law enforcement agencies in the U.S. and EU to share information, and could provoke some form of retaliation or sanction. However, Mr.Tantleff doesn't foresee the Trump administration talking steps to harm U.S. businesses - though there’s got to be something to replace it, in the event the pact was abandoned.

Because there are other ways for companies to share data while maintaining the proper protections - such methods include model contracts and ad hoc agreements - the order should only affect companies that rely on Privacy Shield to transfer data.