On July 10^th, 2023, the European Commission adopted its adequacy decision on the EU-U.S. Data Privacy Framework (“DPF”). This is the third in a series of adequacy decisions on transatlantic data transfer frameworks issued by the European Commission. The first two frameworks, the Safe Harbor (2000) and Privacy Shield (2016), were declared invalid by the Court of Justice of the European Union (“CJEU”) in the Schrems I (2015) and Schrems II (2018) decisions, respectively.

The DPF utilizes a similar self-certification mechanism and maintains the same Principles as the Privacy Shield. But, the DPF is supported by President Biden’s Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities (“EO”), which binds U.S. intelligence agencies to revised and strengthened restrictions on access to personal data. The EO also created a new Data Protection Review Court, with the goal of providing adequate redress for data subjects – something that the CJEU found lacking in the DPF’s predecessors.

Max Schrems has already announced that he is ready to file a CJEU challenge to the latest adequacy decision. While the future of the DPF is uncertain, there are approaches U.S. companies can take in the interim to reduce GDPR risks.

Additional information on the DPF, what companies are affected, and more, can be found in the Technology Law Dispatch blog post here, by Cynthia O’Donoghue, Asélle Ibraimova, Dr. Andreas Splittgerber, Christian Leuthner, Friederike Wilde-Detmering & Sven Schonhofen.