New Adequacy Decision for EU-US Data Transfers Reached
The European Commission has finally adopted the adequacy decision for the EU-US Data Protection Framework, reopening the door for unimpeded trans-Atlantic data transfers.
This is the third attempt at passing the framework, as the EU Court of Justice previously invalidated two data transfer agreements (Schrems I and Schrems II) after complaints from data protection activist group NOYB brought cases before the European courts.
The Court ruled that EU citizens did not have adequate data protections when their personal data was transferred from the European Economic Area to US companies, thus striking those previous agreements down.
The new agreement addresses this problem and enables the lawful transfer of personal data from the European Union by establishing a framework of data protections and data subject rights that US companies must implement and respect, in addition to self-instituted guardrails on the data collection operations US intelligence agencies can run on foreign data.
US businesses will also need to:
- Comply with requirements such as data minimization and secure data sharing.
- Honor European data rights as prescribed in the GDPR
- Allow the Federal Trade Commission to oversee compliance
