EC Adequacy Decision on Data Flows Emerges; Challenge Coming

The U.S. now ensures sufficient privacy protection to allow Europeans' personal data to be transferred there, the European Commission said Monday. Its long-awaited adequacy decision allows personal data to flow between the U.S. and EU under the terms of the Data Privacy Framework negotiated by the two regions. The framework introduces new binding safeguards to address all the concerns of the European Court of Justice in Schrems II, including limiting access to EU data by U.S. intelligence services to what is necessary and proportionate, and creating a data protection review court which EU residents can access if they believe their data has been misused, the EC said. It will periodically assess how the framework is working, starting a year from the date the decision takes effect. The U.S. government said Wednesday it had fulfilled all its commitments to allow trans-Atlantic data flows to resume (see Ref:2307030035]). Completion of the adequacy decision was cheered by the Computer & Communications Industry Association. "This is a major breakthrough," said Europe Public Policy Director Alexandre Roure: "After waiting for years, companies and organisations of all sizes on both sides of the Atlantic finally have the certainty of a durable legal framework" for personal data transfers. None of Your Business Chair Max Schrems, who successfully challenged former regime Privacy Shield, said he expects this matter to be "back at the Court of Justice by the beginning of next year." There are various options for a challenge that should arrive at "an answer if the Commission's tiny improvements were enough or not." Privacy advocates continue to contest U.S. bulk data collection and redress mechanisms, he said. The framework is “critical to returning legal certainty for U.S. businesses relying on the data flows that underpin the $7.1 trillion transatlantic relationship," said U.S. Chamber of Commerce Senior Vice President-Europe Marjorie Chorlins in a statement. It will “safeguard the privacy rights of individuals, while facilitating data flows which are the lifeblood of economic growth and innovation.”