On 13 December 2022, the European Commission initiated the process towards the adoption of an adequacy decision for the European Union (EU) - United States (US) Data Privacy Framework, which will foster safe transatlantic data flows and address the concerns raised by the Court of Justice of the European Union in its Schrems II decision of July 2020.

This is a positive step following the Executive Order proposed by US President Joe Biden on 7 October 2022 to implement the EU-US TADPF and replace the invalidated Privacy Shield

The draft adequacy decision, which reflects the assessment by the European Commission of the US legal framework and concludes that it provides comparable safeguards to those of the EU, has now been published and transmitted to the European Data Protection Board (EDPB) for its opinion. The draft decision concluded that the US ensures an adequate level of protection for personal data transferred from the EU to US companies.

Once the adequacy decision is adopted, European entities will be able to transfer personal data to participating companies in the US, without having to put in place additional data protection safeguards.

The functioning of the EU-US Data Privacy Framework will be subject to periodic reviews, which will be carried out by the European Commission, together with European data protection authorities, and the competent US authorities. The first review will take place within one year after the entry into force of the adequacy decision, to verify whether all relevant elements of the US legal framework have been fully implemented and are functioning effectively in practice.

The publication of the draft text kick-starts the ratification process, which may take up to six months. The adequacy procedure for the previous Privacy Shield Framework took about half a year.

The European Commission’s press release can be found here and Q&As here.

The draft adequacy decision can be found here.