European Commission approves EU-US Data Privacy Framework
14 July 2023
On 10 July 2023, the European Commission adopted a new adequacy decision, approving the EU-US Data Privacy Framework (the "Framework"). The Framework will make it much easier for European parties to share personal data with parties in the United States. US organisations participating in the Framework will subject themselves to stricter personal data processing requirements, which allows European parties to share personal data without having to put in place additional measures.
Our News Update of 22 December 2022 already elaborated a little on the background and details of the draft Framework, which has now become final. The Framework succeeds the EU-US Privacy Shield, which the European Court of Justice invalidated in its Schrems II judgment in 2020 as it found that the rights of EU citizens were not adequately protected. The European Commission believes the Framework removes the Privacy Shield's shortcomings.
The Framework provides several safeguards to ensure an adequate level of data protection. In the United States, an executive order was signed last year that sets boundaries on US intelligence services' collection of data. Under the executive order, their access to EU data is now limited to what is necessary and proportionate to protect national security. In addition, the executive order regulates supervision of intelligence activities. EU citizens can turn to the newly established Data Protection Review Court (DPRC) to complain or object about the handling of their data.
Critics point to the limited substantive differences between the former Privacy Shield and the new Framework. The future will tell whether the Framework will be able to withstand any judicial scrutiny.
