European Union: Issued draft adequacy decision for the EU-US Data Privacy Framework

On 13 December 2022, the European Commission announced that it had initiated the adoption process of the adequacy decision for the EU-US Data Privacy Framework, which aims to enable the transfer of data between the countries and resolve the concerns raised by the EU Court of Justice in the annulment of Schrems II. The draft adequacy decision was issued following the adoption of the Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities by US President Biden on 7 October 2022, implementing the agreement in principle reached by the parties. In its draft adequacy decision, the Commission noted that the US legal framework provides comparable data protection safeguards to those in the EU. The US Executive Order established the principles by which signals intelligence activities are to be authorised and conducted. These principles specify that signals intelligence activities shall only be conducted for defined legitimate purposes if necessary and subject to oversight. Furthermore, the Executive Order established rules regarding the dissemination, processing, and retention of information collected as part of signals intelligence activities and includes a redress mechanism to enable individuals from "qualifying states" to obtain review and redress if their personal information was collected and processed in violation of US law. The draft adequacy decision now goes to the European Data Protection Board, the committee of EU Member States' representatives and Parliament for review. The Commission will adopt the final adequacy decision after receiving the opinions from the institutions.