European Commission Adopts New Adequacy Decision For EU-US Data Transfers

On 10 July 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework (DPF). The DPF allows transfers of personal data between EEA based organisations and US companies participating in the DPF, without the requirement for additional measures such as the use of standard contractual clauses (SCCs).

The DPF requires participating US companies to self-certify adherence to the "EU-US Data Privacy Framework Principles" (DPF Principles) on an annual basis. The DPF Principles broadly reflect the requirements of the GDPR: for example, concerning security, transparency and data subject rights, and those principles are intended to provide data subjects with a level of protection comparable to that given by EU law when their personal data is transferred to the United States.