Adequacy Decision For The EU-U.S. Data Privacy Framework

The European Commission has adopted an adequacy decision for the EU-U.S. Data Privacy Framework ("DPF"). This means that personal data can now be transferred from EU to U.S. organisations certified under the framework without the need for additional data protection and security measures.

The new framework addresses concerns raised by the European Court of Justice in relation to the Schrems II case (C-311/18). It introduces restricted access to EU data by U.S. intelligence services to what is necessary and proportionate. Additionally, a Data Protection Review Court ("DPRC") has been established, granting EU individuals access to independent redress mechanisms.

The DPF also requires U.S. organisations to commit to a detailed set of privacy obligations, such as deleting personal data when it is no longer necessary and ensuring continuity of protection when sharing data with third parties.