EU-US Data Transfers: Adequacy Decision Confirmed

Previously, data was shared between the EU and the US under the EU-US Privacy Shield.

However, the landmark ruling achieved by data activist Maximillian Schrems rendered the mechanism defunct in 2020, rendering the transfers of personal data from the EU to the US restricted (and therefore prohibited) unless alternative measures were implemented (see below).

Under the EU GDPR, transfers of EU citizen’s personal data out of the EU are restricted unless:

• An adequacy decision has been made by the EC for the country or organisation receiving the personal data. An adequacy decision is a decision made by the EC that the country or organisation ensures a level of protection to personal data equivalent to that afforded under the EU GDPR; or
• Appropriate safeguards are implemented between the sender and the recipient to ensure that the personal data is afforded a commensurate level of protection as is afforded by the EU GDPR. Appropriate safeguards primarily take the form of standard contractual clauses (SCCs) or binding corporate rules (BCRs) and are effectively contractual terms between two entities committing to the protection of personal data; or
• An exemption applies. The EU-US Privacy Framework, therefore, allows personal data to flow freely from the EU to US companies certified under the EU-US Privacy Framework without the need to put appropriate safeguards in place or rely on an exemption. 

Therefore, US organisations can apply to the US Department of Commerce for certification, and once certified, EU organisations can allow the transfer of personal data to flow freely.