On 10 July 2023, the European Commission adopted a new adequacy decision finding that the US guarantees a level of protection of personal data equivalent to that of the European Union. The EU-US Data Protection Framework follows changes made by the United States to its national legislation in order to bring the protection of personal data transferred from the European Union to US organisations to an appropriate level.
The bodies that provide the binding guarantees introduced by the new framework are included in a list published by the U.S. Department of Commerce. Transfers of personal data from the EU to the bodies included in this list can therefore be carried out freely, without the need for “standard contractual clauses” or other transfer instruments.
The adequacy decision follows the invalidation by the Court of Justice of the European Union of the previous adequacy decision (Privacy Shield) in 2020 due to fears of surveillance by US intelligence services. The new legal framework provides additional safeguards for US intelligence agencies’ access to data collected in Europe, including by introducing the concepts of necessity and proportionality.
It also gives European citizens a legal remedy if they consider that their personal data has been illegally collected by the US secret services and allows them to obtain the deletion or rectification of such data, if necessary.
In practice, data subjects can file a data breach notification with their national data protection authority, which will ensure that the notification is properly transmitted to the United States through the European Data Protection Board (EDPB). The national authority will ensure that the person concerned receives any additional information relating to the procedure and that he or she is informed of the final decision, i.e. either that no breach of US law has been identified or that a breach has been identified and that it has been remedied.
"Today we take an important step to provide trust to citizens that their data is safe, to deepen our economic ties between the EU and the US, and at the same time to reaffirm our shared values", said the President of the European Commission, Ursula von der Leyen (Press release, European Commission, 10 July 2023).
The European Commission has published an FAQ providing details on the subject. The EDPB will publish further information on this subject in the near future.