The European Commission has adopted a new adequacy decision this July for the transfer of personal data from the European Union to the United States. The new decision, which replaces the Privacy Shield, is designed to ensure that personal data transferred to the United States is protected in a way that is consistent with EU data protection law.

The new adequacy decision includes a number of new safeguards. For example, the new decision requires the US government to provide greater transparency about its surveillance programs, and it gives individuals more control over their personal data.

The European Commission has said that the new adequacy decision “provides a strong legal basis for the continued transfer of personal data from the EU to the US.” However, some privacy advocates have expressed concerns about the new decision, arguing that it does not go far enough to protect the privacy of EU citizens.

The new adequacy decision is still subject to review by the European Parliament and the Council of the European Union. However, if it is approved, it will come into force on December 27, 2023.

Here are some of the key benefits of the new adequacy decision:

  • The DPF is based on a decision by the European Commission that the US provides an adequate level of protection for personal data transferred from the EU. This means that companies and organisations do not need to implement additional safeguards or obtain individual consent to transfer data to the US, as long as they comply with the DPF rules.
  • The DPF includes several commitments and guarantees from the US government regarding the limitations and safeguards for access to data by US intelligence agencies, in line with the principles of necessity and proportionality. The US has also established an independent ombudsperson mechanism to handle complaints from EU individuals about possible misuse of their data by US authorities.
  • The DPF also provides several rights and remedies for EU individuals, such as the right to access, rectify, erase or restrict the processing of their data by US companies, and the right to lodge complaints with their national data protection authorities or with alternative dispute resolution bodies. The DPF also ensures that EU individuals can seek judicial redress in the US courts if their data is unlawfully accessed or used by US authorities.
  • The DPF will be subject to regular monitoring and review by both sides, at least once a year, to ensure that it continues to function effectively and provide adequate protection for personal data. The European Commission can suspend, amend or repeal the adequacy decision if it finds that the DPF is no longer ensuring an adequate level of protection.

Here are some of the key concerns about the new adequacy decision:

  • It does not address all of the concerns that privacy advocates have raised about the US surveillance regime.
  • It does not provide for independent oversight of the US government’s compliance with EU data protection law.

Overall, the new adequacy decision is a significant improvement over the Privacy Shield. However, it is still not perfect, and privacy advocates will continue to monitor the situation closely.

What does this mean for businesses?

The new adequacy decision will mean that businesses that transfer personal data from the EU to the United States can continue to do so without having to take any additional measures. However, businesses should still review their data transfer practices to ensure that they are compliant with EU data protection law.

What can individuals do?

Individuals who have concerns about the transfer of their personal data to the United States can contact the European Commission or their national data protection authority. They can also exercise their rights under EU data protection law, such as the right to access their personal data and the right to object to the processing of their personal data.

The DPF is expected to benefit both EU and US businesses and consumers, as it will facilitate cross-border data flows and foster digital trade and innovation, while respecting privacy and security. However, the DPF is not immune from legal challenges, as some privacy campaigners and activists have expressed doubts about its adequacy and compliance with EU law. Therefore, it remains to be seen how long and how well the DPF will withstand judicial scrutiny and political pressure in the future.

Read more by clicking the link below.