New Adequacy Decision For EU-US Data Transfers

Following a series of discussions between the European Commission and US Government, an adequacy decision for the EU-US Data Privacy Framework ('Framework') was adopted by the European Commission on 10th July 2023. This Framework is intended to replace the previously invalidated Privacy Shield framework and ensure an adequate level of protection afforded to personal data transferred from the EU to the US.

Background

In the Schrems II Ruling (CJEU-C-311/18), the CJEU invalidated the Privacy Shield which was in force at the time. A number of issues were brought forward, including the lack of effective judicial remedy available for EEA data subjects, as well as the fact that US national security laws do not adequately comply with EU standards of proportionality and necessity for data processing, allowing the US Government a disproportionate level of access to personal data.