EU issues a draft adequacy decision for EU-US data transfers

The EU Commission has today issued a draft decision according to which the United States commits to an adequate level of protection for personal data transferred from the EU to the US.

The draft decision, which addresses the concerns of the Court of Justice of the European Union in the Schrems II case in July 2020, has now been submitted to the European Data Protection Board (EDPB) for its opinion. The decision includes legal duties for companies and avenues for individuals’ redress. The next step is approval from a committee composed of representatives of the EU Member States. The European Parliament also has a right of scrutiny over adequacy decisions. The Commission can adopt the final adequacy decision once these steps have been completed.

The functioning of the EU-US Data Privacy Framework will be subject to periodic reviews, which will be carried out by the European Commission, together with European data protection authorities, and the competent US authorities. The first review will take place within one year after the entry into force of the adequacy decision.

See: 

• European Commission - Data protection: Commission starts process to adopt adequacy decision for safe data flows with the US
• European Commission - Adequacy decision for the EU-US Data Privacy Framework

Follow these developments in Privacy Laws & Business International Report.