News reaction: The European Commission adopts EU-US Trans-Atlantic Data Privacy Framework

In October 2022, President Biden signed an Executive Order (EO) to implement a new European Union (EU) and United States (U.S.) data privacy network. Its purpose was to re-establish the legal framework around the transfer of personal data from the EU to the U.S., known as transatlantic data flows.

This week, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework, concluding that the U.S. will ensure an adequate level of protection – comparable to that of the EU – for personal data transferred from the EU to U.S. companies.

Organisations that are based in the U.S. that had self-certified to Privacy Shield can start relying on this adequacy decision provided they update their privacy policies by 10 October 2023 to reflect the new Framework. This will allow them to receive personal data transfer from the EU/European Economic Area.

There are different requirements for the Swiss and UK extensions to the Framework.

For further details on of the new framework, including what organisations need to be aware of, read out news story What does the EU-US Trans-Atlantic Data Privacy Framework mean for organisations?

Stephen Bailey, Global Privacy Services practice lead at NCC Group, comments on what this news means for organisations moving forward.

With the sweep of its procedural pen, the European Commission has today formally adopted its adequacy decision for the EU-U.S. Data Privacy Framework, which means that it is happy that the protection offered to personal data being transferred to the U.S. is comparable to that provided within the EU Member States.

This means, albeit it temporarily as there is at least one significant legal challenge to be launched imminently, that organisations now have a degree of legal certainty over existing or planned transfers of data from the EU to the U.S.. How much confidence organisations have in today’s news remains to be seen.

The European Commission will continue to monitor relevant developments in the U.S. and review the adequacy decision on an ongoing basis.

To read the full announcement, click here.