The European Commission Adopted An Adequacy Decision For The EU-US Data Privacy Framework

On July 10, 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework ("DPF"). The DPF is the successor to the EU-US Privacy Shield, which the Court of Justice of the European Union ("CJEU") declared invalid in 2020.

– Background

The CJEU annulled two previous agreements that allowed the transfer of European citizens' personal data to the U.S. —a 2000 deal called Safe Harbour and the Privacy Shield dated 2016.

Maximillian Schrems, an Austrian citizen and a Facebook user lodged a complaint with the Irish supervisory authority (the Data Protection Commissioner), taking the view that, in the light of the revelations made in 2013 by Edward Snowden concerning the activities of the United States intelligence services (in particular the National Security Agency ('the NSA')), the law and practice of the United States did not offer sufficient protection against surveillance by the public authorities of the data transferred to