European Commission publishes draft adequacy decision for the EU-US

Published 22 diciembre 2022

On 13 December 2022, the European Commission published a draft adequacy decision for the EU-US Data Privacy Framework (the Draft Decision). If approved, EU organisations will have the ability to freely transfer personal data to US organisations who are ‘certified’ under the Framework. Certification can be gained if an organisation commits to a new set of privacy principles – the ‘EU-US Data Privacy Framework Principles’.

The Draft Decision sets out a careful analysis of the new US legal framework. The Commission concludes that it is comfortable that the US has demonstrated that it is effective in ensuring an adequate level of protection and comparable safeguards to the EU.

The European Commissioner for Justice, Didier Reynders, expressed confidence that “strong safeguards are now in place in the U.S. to allow the safe transfers of personal data between the two sides of the Atlantic” and that the new Framework “will help protect the citizens’ privacy, while providing legal certainty for businesses”¹.

Although the Draft Decision may have been published sooner than many had anticipated, the finalisation of the Framework is not expected until around July 2023 – following the opinion of the EDPB, consultation with the relevant stakeholders, and approval from a committee comprised of representatives of the EU Member States.

However, this timeline doesn’t take into account the potential challenge by Max Schrems, who has already strongly criticised the Draft Decision and the Framework, indicating that a “Schrems III’ case may be on the horizon. This may mean that, even if the Draft Decision is approved, in reality, there is little take up of the Framework. For now, a timely reminder that the deadline for remediating EU transfers using the old Standard Contractual Clauses is 27 December 2022.

¹https://ec.europa.eu/commission/presscorner/detail/en/ip_22_7631