New Privacy Shield Framework In The Works, Favoring Continuity Over Change For Businesses

President Biden and EU leaders announced on March 25, 2022 an agreement in principle to craft a replacement for the Privacy Shield and expand options for trans-Atlantic data transfers in accordance with the General Data Protection Regulation ("GDPR").

Background

The GDPR requires that transfers of personal data of EU residents to countries outside of the EU must take place pursuant to an approved transfer mechanism, provided the recipient country has not received a decision by the European Commission that the its data protection laws are adequate.  Various states – including Canada, Israel, Japan, South Korea, and the UK – are considered by the European Commission to have "adequate" data protection laws.  Importantly, the United States has never received such a determination.  Since the GDPR went into effect, the U.S.'s status has left few avenues for lawful transfers to the United States.When the GDPR came into force, most transfers took place pursuant