On 10 July 2023, the European Commission adopted the adequacy decision on data privacy between the EU and the US, allowing personal data to be transferred from the EU to companies located in the US that adhere to the Data Privacy Framework. The decision takes immediate effect.
After the Court of Justice of the European Union invalidated the European Commission’s previous adequacy decisions (Safe Harbour and Privacy Shield) allowing international transfers of personal data to the US (Schrems I and Schrems II judgments), the Commission has again reached an agreement with the U.S. authorities (U.S. Department of Commerce) to allow individuals and entities in the European Union to transfer personal data to the U.S. in a secure manner.
The adoption of this decision incorporates a series of guarantees for European citizens wishing to exercise their rights on US territory and aims to address the concerns that had been raised by the Court of Justice of the European Union (CJEU) through its ruling on the European Court of Human Rights (ECtHR):
• Limiting access to EU data by US intelligence services to “what is necessary and proportionate” and,
• Establishing a Data Protection Review Tribunal.
As a result, this agreement allows the use of the Standard Contractual Clauses to be waived with all those entities in the US to which data is transferred, provided that these recipient entities have adhered to this new framework. The directory of adhering entities will be available at https://www.dataprivacyframework.gov/s/.
In conclusion, with the entry into force of this adequacy decision, companies in the US adhering to the programme ensure an adequate level of data protection comparable to that of the European Union, which is a major step towards simplifying transfers of personal data to the US by all Controllers processing personal data of EU citizens.
