European Commission issues draft adequacy decision on EU-U.S. Data Privacy Framework.
The European Commission has issued its draft adequacy decision on the EU-U.S. Data Privacy Framework (DPF) on December 13, potentially opening the door to another method of trans-Atlantic flow for personal data. The next step is for the draft adequacy decision to go through the EU’s formal approval process, which first includes a non-binding opinion from the European Data Protection board (EDPB) followed by a full vote by the member states.
However, the DPF faces an uphill battle. Some EU regulators have already suggested that the DPF, and President Biden’s executive order, fall well short of the level of protection required by the GDPR, and members of the EU Parliament’s Civil Liberties committee have announced that they will work on a non-binding resolution opposing the DPF after the EDPB’s opinion is released. And Max Schrems has already suggested a prompt legal challenge to the adequacy of the DPF.
Ultimately this means continued uncertainty for organizations who need to export personal data from the EU to the United States. Such organizations may be best served by sitting back, relaxing, and using the Standard Contractual Clauses and waiting for the dust to settle.
Today, the European Commission launched the process towards the adoption of an adequacy decision for the EU-U.S. Data Privacy Framework, which will foster safe trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union in its Schrems II decision of July 2020.
View referenced article
Today’s draft decision follows the signature of a US Executive Order by President Biden on 7 October 2022, along with the regulations issued by the US Attorney General Merrick Garland. These two instruments implemented into US law the agreement in principle announced by President von der Leyen and President Biden in March 2022.
