A Cautious Approach: What Does The EU-US Adequacy Decision Actually Mean For International Data Transfers?

On 10 July 2023, the European Commission adopted its long-awaited adequacy decision for the EU-US Data Privacy Framework ("DPF") finding that data transfers from Europe to the US pursuant to the DPF would benefit from an adequate level of data protection.

The adoption of the adequacy decision provides some much-needed certainty around EU-US international data transfers, particularly in light of the recent decision of the Irish Data Protection Commissioner's enquiry finding that international data transfers from Meta Ireland to the US pursuant to the European Commission's Standard Contractual Clauses ("SCCs") had infringed the GDPR (refer to our blog post here).

However, given the previous criticism of the draft DPF by prominent authorities such as the EDPB; the legal challenge to the DPF expected from Max Schrems and his non-profit organisation noyb; the chequered history of US adequacy decisions (the "Safe Harbor" and the "Privacy Shield"); and the fact that