On Tuesday, December 13, the European Commission initiated its long-awaited process towards the adoption of an adequacy decision for the European Union (EU)-U.S. Data Privacy Framework (EU-U.S. DPF), which aims to address the concerns raised by the Court of Justice of the EU when it struck down the European Commission's adequacy decision underlying the EU-U.S. Privacy Shield framework in 2020.
President Biden and European Commission President von der Leyen previously announced they had reached an agreement in principle on the new EU-U.S. DPF in March 2022 (see our previous alert here). Subsequently, on October 7, 2022, President Biden signed the long-anticipated executive order (EO) on Enhancing Safeguards for United States Signals Intelligence Activities, outlining key directives to implement the U.S.'s commitments under the EU-U.S. DPF (see prior alert here).
The European Commission's latest draft adequacy decision outlines its assessment of President Biden's EO, concluding that it provides an adequate level of protection for personal data transferred from the EU to U.S. companies.
The European Commission will now obtain an opinion from the European Data Protection Board (EDPB) and seek the approval of a committee comprised of the representatives of the EU member states; the European Parliament also retains the right to oversee adequacy decisions. It is only once the review by the relevant EU institutions has been completed that the European Commission can adopt the final adequacy decision in respect of the U.S. and, thereafter, allow data to flow freely between the EU and U.S. companies certified by the U.S. Department of Commerce under the EU-U.S. DPF.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
