BEERG Newsletter - EU/US Data Flows: EU moves a step closer to adequacy decision

Derek Mooney writes: In an article on President Biden’s October 7^th Executive Order to allow easier, unobstructed EU/US data flows (See Issue #32 HERE), we predicted that the EU Commission will formally adopt a new adequacy decision under the EU GDPR for the new EO and the Framework around March /April 2023.

That timeframe is looking good with the announcement on Tuesday last (13 December) that the European Commission had initiated the formal process for adopting an adequacy decision on the EU-US Data Privacy Framework by publishing its Draft Adequacy Decision. 

The draft adequacy decision will now go through its adoption procedure. As a first step, the Commission submitted its draft decision to the European Data Protection Board (EDPB). Afterwards, the Commission will seek approval from a committee composed of representatives of the EU Member States. In addition, the European Parliament has a right of scrutiny over adequacy decisions. Once this procedure is completed, the Commission can proceed to adopting the final adequacy decision. This is still expected by April 2023.

The functioning of the EU-U.S. Data Privacy Framework will be subject to periodic reviews, which will be carried out by the European Commission, together with European data protection authorities, and the competent US authorities. The first review will take place within one year after the entry into force of the adequacy decision, to verify whether all relevant elements of the US legal framework have been fully implemented and are functioning effectively in practice.