Under the European Data Directive and its successor, the General Data Protection Regulation, data of a European subject may be transferred out of the EU only via an approved international framework or through approved Standard Contract Clauses (SCC) contained in Data Protection Agreements or binding corporate rules approved by the relevant data protection authority.
Beginning in 2000, the international framework in place was the US-EU Privacy Safe Harbor Program. Austrian lawyer and privacy advocate Max Schrems challenged the adequacy of the Safe Harbor Program citing revelations from Edward Snowden as to U.S. intelligence agencies’ surveillance activities. In 2015, the European Court of Justice agreed with Schrems and invalidated the Safe Harbor Program.
In 2016, the two economic powers agreed to the US-EU Privacy Shield, but this was invalided again in Schrems II. See Schrems II – European Court of Justice Invalidates US-EU Privacy Shield. This forced businesses to rely on SCCs to transfer data from Europe.
In March 2022, the US and EU agreed to a new framework – the Transatlantic Data Privacy Framework. This framework added enforceable safeguards from US surveillance for EU citizens (including a Data Protection Review Court).
This week the European Commission adopted an adequacy decision finding that the US ensures an adequate level of protection compared to that of the EU. On the basis of the new adequacy decision, personal data can flow safely from the EU to US companies participating in the Framework, without having to put in place additional data protection safeguards.
Max Schrems intends to appeal the determination arguing that it is little different than the Privacy Shield invalidated in 2020. Schrems trolled US privacy authorities by showing that the framework’s website was still under construction and still referenced the invalidated Privacy Shield.
See Congressional Research Service, The EU-U.S. Data Privacy Framework: Background, Implementation, and Next Steps (Oct. 2022).
Cyber Report 