Data's damp squib – The latest iteration of the EU-US data privacy framework

On 10 July 2023, the European Commission (EC) adopted an adequacy decision regarding the EU-US Data Privacy Framework (the Framework). The EC decided that the Framework offers an equivalent level of data protection to the EU GDPR. This affects participating US businesses, who will self-certify their compliance with a range of privacy principles outlined within the Framework. The decision provides a new mechanism for trans-Atlantic data flows from the EU to the US, placing a lesser burden on the exporter than alternative mechanisms, such as the Standard Contractual Clauses.

If this sounds familiar, it is because of its similarity to its predecessors, the failed 'Safe Harbor' and 'Privacy Shield' schemes. Both prior schemes were ultimately struck down by the Court of Justice of the European Union (CJEU) in decisions colloquially referred to as 'Schrems I' and 'Schrems II'. The failure of both prior schemes rested heavily on the broad extent of surveillance by the US