New EU-US Data Privacy Framework Promises Greater Ease For Cross-Border Transfers, But Uncertainty Remains

Ed. Note: Thank you to Summer Associate Nicole Onderdonk for her significant contributions to this post.

On July 10, 2023, the European Commission (EC) adopted its adequacy decision for the EU-U.S. Data Privacy Framework (EU-U.S. DPF, or "Privacy Framework"), which establishes the Privacy Framework as an authorized mechanism under the General Data Protection Regulation (GDPR) for personal data to be transferred freely from the European Union (EU) to United States (U.S.) companies, effective immediately.

The EU-U.S. DPF replaces the defunct EU-U.S. Privacy Shield Framework, ruled invalid as a transfer mechanism by the Court of Justice of the European Union (CJEU) in its July 2020 ruling in the Schrems II case. The new Privacy Framework introduces two binding safeguards that directly address concerns raised by the CJEU in Schrems II regarding U.S. intelligence agencies' surveillance programs and appropriate redress for EU citizens who believe their data rights have