New draft adequacy decision for EU-U.S. transfers of personal data

So, what is an adequacy decision ("AD")? Under the GDPR Article 45, the European Commission may decide that transfers to a third country (or an international organization) can take place based on an assessment that the level of protection in that third country is adequate. Article 45 provides instructions for how the European Commission shall perform the assessment. Where a third country is subject to an AD, the data exporter does not have to implement any additional safeguards such as the EU Standard Contractual Clauses, Binding Corporate Rules etc. in order to transfer personal data to that third country.

In the draft AD, the European Commission states that it has 'carefully analysed U.S. law and practice' (cf. para. 7), including the recent US Executive Order 14086 "Enhancing Safeguards for US Signals Intelligence Activities" of 7 October 2022, a new "Regulation on the Data Protection Review Court" issued by the U.S. Attorney General and the updated framework the "EU-U.S. Data Privacy Framework".

The draft AD will now be reviewed by the European Data Protection Board who will give its opinion. The draft AD will be subject to the approval by a committee comprised of EU Member State representatives. When these steps have been completed, the European Commission may proceed to adopt the final AD. The European Parliament and the Council may at any time request the European Commission to amend or withdraw the adequacy decision on the grounds that it is exceeding its implementing powers under the GDPR.

Although it is still unclear when, or even if, the AD will be adopted, the Swedish and Norwegian data protection authorities expect it to be adopted before summer 2023.

Unsurprisingly perhaps, the draft AD, including the European Commission's assessment, is controversial. Max Schrems, the Austrian lawyer and founder of the non-profit organization NOYB - European Center for Digital Rights, who has campaigned against transfers to the USA, has already voiced his concerns:

As the draft decision is based on the known Executive Order, I can't see how this would survive a challenge before the Court of Justice. It seems that the European Commission just issues similar decisions over and over again - in flagrant breach of our fundamental rights.'

Other perspectives have been offered as well, such as a more optimistic opinion on the US Executive Order 14086 by the German data protection authority in Hamburg (29 November 2022), which can be found summarised in this article.

Needless to say, it will be very interesting to see how this will all play out in the upcoming months. Schjødt will keep our readers up to date with any further developments.