EU-US Data Privacy Framework Adequacy Decision Adopted By European Commission

Last month, three years after the Court of Justice of the European Union ('CJEU') struck down the EU-US Privacy Shield (the 'Privacy Shield') in Schrems II, the European Commission formally adopted a new adequacy decision with the EU-US Data Privacy Framework (the 'Framework'). The Commission's press release states that the decision concludes that the US will provide an adequate (i.e. essentially equivalent to that of the EU) level of protection for data transfers from EU to US companies under the Framework. The Framework, which has been long awaited, will provide EU companies transferring personal data to the US an additional mechanism to legalise such transfers.

The adequacy decision allows companies that adhere to the Framework to receive personal data from the EU without the need to put in place further transfer safeguards. Companies that previously self-certified under the Privacy Shield will have a streamlined procedure to self-certify under the Framework.