Worldwide: EU-US Data Privacy Framework Adequacy Decision Adopted By European Commission

Last month, three years after the Court of Justice of the European Union ('CJEU') struck down the EU-US Privacy Shield (the 'Privacy Shield') in Schrems II, the European Commission formally adopted a new adequacy decision with the EU-US Data Privacy Framework (the 'Framework'). The Commission's press release states that the decision concludes that the US will provide an adequate (i.e. essentially equivalent to that of the EU) level of protection for data transfers from EU to US companies under the Framework. The Framework, which has been long awaited, will provide EU companies transferring personal data to the US an additional mechanism to legalise such transfers.

The adequacy decision allows companies that adhere to the Framework to receive personal data from the EU without the need to put in place further transfer safeguards. Companies that previously self-certified under the Privacy Shield will have a streamlined procedure to self-certify under the Framework. According to the Commission, the Framework addresses all the concerns raised by the CJEU with respect to US intelligence services having access to personal data from the EU. There will also be a new court, the Data Protection Review Court, that will provide data subjects with a mechanism to challenge access to personal data. The Framework is not static, but rather will be subject to periodic reviews by the Commission, representatives of the EU's data protection authorities, and their equivalents in the US.

The EU Commissioner for Justice, Didier Reynders, stated in a press conference that: 'With the adoption of the Adequacy Decision, personal data can now flow freely and safely from the European Economic Area to the U.S. without any further conditions or authorisations.'

On the possibility of a challenge against the adequacy decision, he stated that the Commission is 'very confident to try to, not only implement such an agreement, but also to defend [the agreement] in all procedures that [such agreement will] have to face.' Max Schrems's organisation noyb ('none of your business') is expected to challenge the Framework and the adequacy decision in the CJEU.

Originally published 21 August 2023

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.