On 13 December 2022, the European Commission issued a first draft adequacy decision (available here) on a potential upcoming EU-US Data Privacy Framework. This is a new step forward in the European Union and United States efforts to address the concerns raised by the Court of Justice of the European Union (CJEU) in its Schrems II decision issued July 2020.
The European Commission's draft adequacy decision follows the signature of a US Executive Order by President Biden on 7 October 2022 to providing enhanced protection for the free flow of personal data between the EU and the US under a "durable and reliable legal basis for transatlantic data flows." In a nutshell, the draft adequacy decision provides that the EU-US Data Privacy Framework based on the abovementioned Executive Order ensures a comparable level of safeguards for data subjects and their personal data than that in the EU.
The draft adequacy decision has now been transmitted to the European Data Protection Board who will perform its own assessment and publish its opinion.
Read this next
- Data Transfers: US Executive Order and EU Commission draft adequacy decision
- CJEU invalidates the Privacy Shield: implications for EU-US personal data transfers
- EDPB's FAQ about the invalidation of the Privacy Shield
- EDPB Recommendations 01/2020 and 02/2020 on transfers of personal data after Schrems II
- Fiche pratique : Arrêt Schrems II de la CJUE : que faire ?
- GDPR - Transfers of personal data in the UCI world after Schrems II
- GDPR compliance - New standard contractual clauses
- GDPR: EU Commission's Q&A about the New Standard Contractual Clauses for Transfers
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.