Rethinking EU-US Personal Data Transfers And Their Effect On Transfers From Serbia

The European Commission adopted a new system for EU-US personal data transfers, the Data Privacy Framework (DPF), on 10 July 2023. Its enactment, the "adequacy decision", is set to replace the invalidated Privacy Shield after it faced heavy criticism in the Schrems ll ruling. This will be the third attempt to devise an adequate method to protect personal data transfers from companies in the EU to the US, and we are yet to see any improvement in practice.

On the other hand, the Serbian Data Protection Adequate list formally enlisted the US as a safe place to transfer data without any safeguarding mechanism needed for all this time post-Schrems II, though the advice of the Serbian Data Protection Commissioner (the "Commissioner") was to conclude Serbian Standard Contractual Clauses and continue with transfers to the US.