The European Commission has adopted its adequacy decision for the EU-US Data Privacy Agreement, allowing organizations to engage in the free flow of personal data between the two regions without additional safeguards.
The announcement on July 10, 2023, confirms a preliminary agreement between the US government and the EU for a new Data Privacy Framework in March 2022. This model replaces the previous Privacy Shield arrangement between the two regions, which was ruled unlawful by the Court of Justice of the European Union (CJEU) under GDPR rules in the Schrems II case in 2020.
This ruling was due to concerns that US law enforcement agencies could access data transferred from the EU to the US. As a result, the process of transferring personal data from the EU to the US has become far more complex, with organizations having to use alternative mechanisms like standard contractual clauses.
Commenting on the new framework, President of the European Commission, Ursula von der Leyen, said: “The new EU-US Data Privacy Framework will ensure safe data flows for Europeans and bring legal certainty to companies on both sides of the Atlantic.
“Following the agreement in principle I reached with President Biden last year, the US has implemented unprecedented commitments to establish the new framework. Today we take an important step to provide trust to citizens that their data is safe, to deepen our economic ties between the EU and the US, and at the same time to reaffirm our shared values. It shows that by working together, we can address the most complex issues.”
In coming to the decision, the European Commission concluded that the US has an adequate level of data protection comparable to that of the EU, allowing personal data to be transferred safely across the Atlantic. The EU said the updated framework addresses concerns raised in the CJEU’s decision in Schrems II. This includes “limiting access to EU data by US intelligence services to what is necessary and proportionate” to protect national security.
In addition, EU citizens will have access to an independent and impartial redress mechanism regarding the collection and use of their data by US intelligence agencies in the form of a newly created Data Protection Review Court (DPRC).
No tags.
