On 13 December 2022, the European Commission officially initiated the process for adoption of an adequacy decision regarding the new EU-US Data Privacy Framework (DPF Adequacy Decision). The draft DPF Adequacy Decision marks the third attempt at accommodating seamless data flows between the EU and the US, which are crucial to unlock the full potential of the transatlantic data economy, following the invalidation of the Safe Harbor Program in the Schrems I judgment and the EU-US Privacy Shield in the Schrems II judgment of the Court of Justice of the European Union (CJEU).

The legislative changes that were introduced in the US legal framework by President Biden’s Executive Order 14086 on Enhancing Safeguards for United States Signals Intelligence Activities (“EO 14086”)(1) along with the Regulation issued by the Attorney General Merrick Garland establishing the Data Protection Review Court(2) have created a new opportunity for a successful transatlantic data transfer framework. Through EO 14086, the US implemented significant data protection commitments that were made during lengthy political discussions between the two economic blocs. These data protection commitments form the basis on which the European Commission, after a detailed analysis, concludes that the US ensures an adequate level of protection for personal data transferred to organizations certified under the DPF (Article 1 of the DPF Adequacy Decision).