Update on Transatlantic Data Transfer - U.S. Does Homework and EU Close to Adopting Adequacy Decision

U.S. Secretary of Commerce Gina Raimondo announced via press release the day before yesterday that the U.S. has implemented its obligations under the EU-US Data Privacy Framework. In parallel, the adoption of the adequacy decision by the EU Commission is coming up soon. According to our information, this should already be completed in the next few days. These are two milestones on the way to a more legally secure data transfer to the USA in the future.

Review

The EU and the USA concluded the EU-US Data Privacy Framework in spring 2022. This is intended to eliminate the legal uncertainties that arose after the Schrems II decision with regard to data transfers to the USA. The EU Commission published a draft adequacy decision at the end of 2022. This attests to an adequate level of data protection in the USA, serves in the future - after its adoption - as a potential legal basis for transatlantic data transfers and is suitable for significantly minimizing the legal uncertainties that currently still exist.

Outlook

However, the adoption of the adequacy decision by the EU Commission would not be a carte blanche. As with the predecessor model of the EU-US Data Privacy Framework, the EU-US Privacy Shield, there is a certification mechanism for US companies. The latter must be certified and subject to the regulations of the EU-US Privacy Framework. As long as this is not done, the adequacy decision cannot be relied upon as a legal basis. In this case, companies must continue to use the standard legal bases (in particular standard contractual clauses, consent, Binding Corporate Rules) and comply with the associated requirements, for example, in the case of standard contractual clauses, the performance of a so-called transfer impact assessment, taking into account the 6-step plan of the European Data Protection Board. The Bavarian Data Protection Authority (BayLDA) has confirmed that it is not sufficient to invoke the adequacy decision as a future legal basis with regard to current data processing operations already now. We will keep you up to date.