Draft adequacy decision on EU-US Data Privacy Framework published by the European Commission

For an outlook of the latest development as at July 2023 in relation to transfers to the US, please read our article about the New EU adequacy decision allowing personal data transfers to US self-certified entities!

On 13 December 2022, the European Commission issued a first draft adequacy decision (available here) on a potential upcoming EU-US Data Privacy Framework. This is a new  step forward in the European Union and United States efforts to address the concerns raised by the Court of Justice of the European Union (CJEU) in its Schrems II decision issued July 2020.

The European Commission’s draft adequacy decision follows the signature of a US Executive Order by President Biden on 7 October 2022 to providing enhanced protection for the free flow of personal data between the EU and the US under a “durable and reliable legal basis for transatlantic data flows.” In a nutshell, the draft adequacy decision provides that the EU-US Data Privacy Framework based on the abovementioned Executive Order ensures a comparable level of safeguards for data subjects and their personal data than that in the EU.

The draft adequacy decision has now been transmitted to the European Data Protection Board who will perform its own assessment and publish its opinion.