European Commission Adopts US Adequacy Decision

On 10 July 2023, the European Commission formally adopted a new US adequacy decision for the EU-U.S. Data Privacy Framework ("DPF"). The adoption of the adequacy decision comes three years after the invalidation of the EU-U.S. Privacy Shield by the Court of Justice of the European Union ("CJEU") in Schrems II .

The European Commission's adequacy decision concludes that the US ensures an adequate level of protection, comparable to that of the EU, for personal data transferred from the EU/EEA to US companies who certify compliance with the DPF.

This article considers the implications of the new DPF, and some practical issues about the self-certification process.

Implications