The EU Commission is committed to promoting secure transatlantic data flows and addressing the concerns expressed by the Court of Justice of the European Union in the "Schrems II" ruling. Against this background, on 13 December 2022, the Commission initiated the procedure for adopting an adequacy decision for the EU-US Data Privacy Framework by submitting its draft decision. This draft ties in with a US decree signed by US President Biden and regulations issued in respect of this. This US act implements a "fundamental agreement" between President von der Leyen and President Biden on a new transatlantic framework for data transfers that was reached in the spring after intense negotiations. The Commission assesses this new US regulatory framework in its draft decision, coming to the conclusion: The USA now ensures an adequate level of protection for personal data from the EU on grounds of sufficient guarantees.
Effect of the adequacy decision in the event of its adoption
Insofar and as soon as the adequacy decision is adopted, European companies may transfer personal data to those companies in the United States that participate in the EU-US Data Privacy Framework without having to introduce additional data protection safeguards.
Essential regulatory content
US companies can participate in the EU-US Data Privacy Framework by committing to a catalogue of data protection requirements.
EU citizens affected by breaches of this Data Privacy Framework shall be afforded various legal remedies.
US intelligence agencies shall be able to access European data only to the extent this is necessary and proportionate to protect national security. An independent and impartial appeals process is also envisaged, including the establishment of a new court to check data protection.
Course of events until the final decision
The draft decision is currently with the European Data Protection Board (EDPB) for its comments. A committee of representatives from the EU member states must then give its approval. The European Parliament still has a right of control. After that, the way is clear for the decision to be finally adopted by the Commission. We expect the final decision within the 1st half of 2023.
Continuous monitoring of the EU-US Data Privacy Framework
The EU Commission, US authorities, and the European data protection authorities will monitor the full and effective practical implementation of the relevant elements of the US legal framework (decree and regulations).
Further details and links to background information can be found here (EU Commission press release of 13 December 2022).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
