As a reminder
The transfer of data outside the European Economic Area may only be done in compliance with Chapiter 5 of the GDPR (for more information, consult our webinar on the topic).
Following the invalidation of the Privacy Shield adequacy decision by the Court of Justice of the European Union on 16 July 2020 (see our article here), the transfer of personal data from European Union Member States to the United States was no longer possible pursuant to Article 45 of the GDPR.
The invalidation has significant practical consequences because several decisions prohibiting transfers to the United States were issued, despite the use by the parties of other mechanisms provided under Chapiter 5 which were judged insufficient by the data protection supervisory authorities. This situation lead to an untenable legal risk for private and public operators who at times were obligated to forgo unique or less expensive technical solutions.
The new adequacy decision between the United States and the European Union
On 10 July 2023 (also the date of its entry into force), the European Commission adopted an adequacy decision in favor of the United States in light of amendments to its national legislation. As in the past, the decision imposes the double requirement that (i) the entities be established in the territory of the United States; and (ii) they have taken the steps to comply with this new framework annually. It is a self-certification system for the American entities. Thus, it should periodically be verified that the entities receiving the personal data are duly certified (and that the certification up to date).
Transfers to non-certified entities remain possible, subject to compliance with our previous recommendations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.