Companies now have an EU-U.S. Privacy Shield replacement to rely upon in order to transfer data from the EU and UK to the U.S.  On July 10, 2023, the European Commission (“EC”) adopted its new adequacy decision for the EU-U.S. Data Privacy Framework (“Adequacy Decision”). The EC’s Adequacy Decision took effect on July 11, 2023, allowing companies to transfer personal data without the need for additional agreements, such as the EU Standard Contractual Clauses (“SCCs”).

The previous Privacy Shield program for the trans-Atlantic transfer of personal data from the EU to the U.S. was struck down by the Court of Justice of the European Union (“CJEU”) in the Schrems II decision. In Schrems II, the CJEU explained that it struck down the previous program because of its particular concern with the U.S. intelligence agencies’ unrestricted access to personal data transferred to the U.S. from the EU. 

Following the CJEU’s invalidation of the previous Privacy Shield programs, in March 2022, President Biden and EU Commission President von der Leyen reached an agreement on certain principles regarding safeguards and restrictions on U.S. foreign intelligence activities. Subsequently, on October 7, 2022, President Biden signed an Executive Order entitled “Enhancing Safeguards for United States Signals Intelligence Activities” (“EO 14086”) that embodied these principles. For instance, EO 14086 requires U.S. foreign intelligence activities to be subjected to enhanced data safeguards and restrictions, which must ensure the privacy and civil liberties of all persons, regardless of nationality. Under EO 14086, an EU or EEA country may be designated as a “qualifying state”, and individuals from a “qualifying state” may seek redress if they believe their personal data were collected through U.S. foreign intelligence activities in a manner that violated applicable law. The U.S. Attorney General can designate, pursuant to EO 14086, an EU or EEA country as a “qualifying state” if (1) the laws of the country (or member country of a regional economic integration organization) require enhanced safeguards in conducting foreign intelligence activities for U.S. persons’ personal data that is transferred from the U.S. to the territory of the country; (2) the country permits the transfer of personal data to the U.S. for commercial purposes; and (3) such designation advances the national interests of the U.S.

Ultimately, EO 14086 became one of the bases for the EC’s formal adoption of the Adequacy Decision. The EC's Adequacy Decision recognizes the U.S., because of EO 14086 (i.e., the redress mechanism and the enhanced safeguards afforded to personal data subjected to U.S. foreign intelligence activities), as having an adequate privacy framework to protect EU individuals’ personal data. Under the Adequacy Decision, EU individuals’ personal data may be transferred to companies in the U.S. that self-certify compliance with the Adequacy Decision’s privacy requirements, as was the case with the “Privacy Shield”.

Beginning July 17, U.S. organizations were able to self-certify to the EU-U.S. Data Privacy Framework on the U.S. Department of Commerce International Trade Administration website.

The Adequacy Decision is a mechanism for secure transfer of personal data from EU to the U.S. distinct from other established mechanisms such as the SCCs and Binding Corporate Rules. In other words, U.S. organizations should be able to continue personal data transfers through those other established EU legal mechanisms. Whether U.S. organizations choose to transfer personal data across the Atlantic under the Adequacy Decision or go forward with the existing data transfer mechanisms will be a matter of strategic decision depending on business considerations, including, among others, the volume of the data transferred, and the means of resolving EU individuals’ complaints regarding their data transferred. Notably, however, organizations utilizing SCCs for their data transfer will be able to refer to the Adequacy Decision in their transfer impact assessments required under those SCCs.

For more information on the Adequacy Decision, please refer to the Factsheet and Q&A on the EC’s website.