On 13 December 2022, the European Commission published a draft of a new adequacy decision for data transfers between the EU and the US.
The draft adequacy decision is a new attempt to securely frame EU-US data transfers, following the annulments of the previous adequacy decisions (the Safe Harbour and the Privacy Shield respectively) by the Court of Justice in the Schrems cases.
The first steps for a new adequacy decision were taken in March 2022 with an agreement in principle between the European Commission and the United States. This agreement was implemented by the US with the executive order signed by the American President, Joe Biden, on 7 October 2022.
The draft adequacy decision in a nutshell
- Introduction of a certification mechanism for US entities. For certified companies, GDPR compliance is mandatory and enforceable;
- Application of GDPR principles to American recipients of EU data (purpose limitation, integrity, prohibition of incompatible further processing, data minimisation, accuracy, security, transparency, etc.);
- Requirement for US recipients of EU data to provide an opt-out mechanism for compatible further processing;
- Determination of strict conditions for further transfers;
- Monitoring and enforcement mechanisms for compliance with the GDPR and the adequacy decision, including compliance monitoring by the U.S. Department of Commerce;
- Various redress remedies for data subjects, including the possibility of filing a claim with independent dispute resolution bodies both in the US and in the EU, filing a claim with national data protection authorities (with the mandatory cooperation of the certified US entity), and having a binding arbitration in front of the “EU-U.S. Data Privacy Framework Panel”; and
- A chapter entirely devoted to regulating the access to EU data for US public authorities.
What’s next?
Before the final adequacy decision can be adopted and applied, a few steps still need to be completed. The draft adequacy decision has already been submitted to the European Data Protection Board (EDPB) for its opinion. Next, the draft will have to be approved by a committee of representatives of the EU Member States.
Max Schrems, the claimant in both Schrems cases, reacted rapidly with a statement on the draft decision. His message is clear: in his opinion, the changes seem minor and will (once again) not survive an appeal to the Court of Justice.
