On Tuesday 13 December, the European Commission launched the process for the adoption of an adequacy decision on the EU-US data protection framework.
The draft decision presented by the Commission follows the signing of a US Presidential Executive Order in October (see EUROPE 13038/12) and the regulations adopted by the US Attorney General, which transposed into US law the agreement in principle announced by President Ursula von der Leyen and President Biden in March 2022 (see EUROPE 12919/1).
It concludes that the US provides an adequate level of protection for personal data transferred from the EU to US companies. These companies will be able to join the EU-US data protection framework by committing to a detailed set of privacy obligations, and EU citizens will have a number of remedies if their personal data is processed in breach of the framework.
Furthermore, according to the Commission, the US legal framework provides a number of limitations and safeguards on US government access to data, in particular for criminal law enforcement and national security purposes, addressing concerns raised by the Court of Justice of the European Union in its July 2020 ‘Schrems II’ decision (see EUROPE 12536/9).
The draft has been sent to the European Data Protection Board (EDPB) for an opinion.
See the project: https://aeur.eu/f/4nk (Original version in French by Camille-Cerise Gessant)