Data Dive

On Tuesday, December 13, the European Commission initiated its long-awaited process towards the adoption of an adequacy decision for the European Union (EU)-U.S. Data Privacy Framework (EU-U.S. DPF), which aims to address the concerns raised by the Court of Justice of the EU when it struck down the European Commission’s adequacy decision underlying the EU-U.S. Privacy Shield framework in 2020.

An executive order implementing U.S. commitments to the new successor agreement to the Privacy Shield, the EU-U.S. Data Privacy Framework was signed by President Biden in October 2022. The order marks a historic step in respect of trans-Atlantic data transfers and creates a new two-tier redress mechanism for individuals in the EU. The order also establishes a number of additional safeguards that constitute a substantive limitation on the U.S. intelligence communities access to and handling of data. 

Last week the Biden administration and the European Commission jointly announced a new trans-Atlantic data flow agreement. While no specifics have yet been made public, a recent press release gives the high-level facts of this pivotal economic agreement, which is the product of more than a year’s worth of negotiations that will “enable the continued flow of data that underpins more than $1 trillion in cross-border commerce every year” (find our previous articles on cross-border data transfer here, and here). This “agreement in principle” would reinstate a framework to allow the free exchange of data between the United States and the European Union (EU) without violating the General Data Protection Regulation (GDPR).

On Wednesday, December 9, the Senate Commerce, Science and Transportation Committee held a hearing titled “The Invalidation of the EU-U.S. Privacy Shield and the Future of Transatlantic Data Flows.” During the hearing, both Chairman Roger Wicker (R-MS) and Ranking Member Maria Cantwell (D-WA) underscored the need to assess how United States businesses can confidently conduct data transfers in compliance with EU laws as negotiations continue to replace the EU-U.S. Privacy Shield agreement.

The U.S. Department of Commerce, Department of Justice, and Office of the Director of National Intelligence have prepared a White Paper providing a detailed discussion and analysis of the July 16^th Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (Schrems II) decision from the Court of Justice of the European Union (CJEU). The White Paper, available here, focuses on providing information to companies involved in the transfer of personal data from the European Union to the United States. As we previously discussed here, the judgment upholds the use of Standard Contractual Clauses but only in certain circumstances, and finds that the EU-U.S. Privacy Shield is an invalid mechanism for transferring personal data from the EU to the U.S. under the General Data Protection Regulation (GDPR).