Draft Decision On Transferring Personal Data From EU to US

On December 31 the European Commission published a draft decision on adequate protection of personal data under the EU-U.S. Data Privacy Framework. It is part of an effort to reestablish a legal regime for transfer of personal data from the EU to the U.S. It came after President Biden signed an executive order on “Enhancing Safeguards for the United States Signals Intelligence Activities,” which established new regulations for collection and use of personal data by U.S. intelligence agencies. Biden’s order and the draft decision are reactions to the 2020 Schrems II decision that invalidated the prior privacy framework, called the Privacy Shield. According to a Privacy & Cybersecurity Update from Skadden Arps, the draft will be examined by other EU institutions before a final adequacy decision is adopted in mid-2023. The draft concludes that the U.S. ensures an adequate level of protection, noting Biden’s executive order. The Skadden Arps Update calls this welcome news for companies that transfer personal data from the EU to the U.S. Such transfers are not currently illegal, but they are cumbersome to implement. The final decision is likely to face legal challenges.