EU-US Data Transfer Framework: Court of Justice Issues Ruling on Adequacy Decision

Strategic Insights -

The Court of Justice of the European Union (CJEU) has issued a ruling on the adequacy decision adopted by the European Commission on July 10, 2023, regarding the transfer of personal data between the European Union (EU) and the United States (US). The decision aims to establish a framework for international transfers of personal data, ensuring a level of protection equivalent to that provided by EU law. This ruling is significant, given the CJEU's previous judgments in Schrems I and Schrems II, which declared two previous adequacy decisions concerning the US invalid due to inadequate protection of fundamental rights and freedoms.

Key Takeaways:

  • The CJEU has ruled on the European Commission's adequacy decision regarding the transfer of personal data between the EU and the US.
  • The decision, adopted on July 10, 2023, aims to establish a new transatlantic framework for personal data flows between the two regions.
  • The framework is based on the US Executive Order (10 October 2022) and the Attorney General Regulation (7 October 2022), which strengthened privacy safeguards for intelligence agencies in the US.
  • The CJEU has previously declared two previous adequacy decisions concerning the US invalid, citing inadequate protection of fundamental rights and freedoms.
  • The new framework is designed to ensure a level of protection equivalent to that provided by EU law, following the Commission's examination of regulatory developments in the US.
  • The decision has significant implications for international data transfers between the EU and the US, particularly in light of the Schrems I and Schrems II judgments.

Specifically, the CJEU's ruling highlights the importance of protecting personal data in international transfers, particularly in the context of intelligence agencies in the US. The decision underscores the need for a robust framework that ensures a level of protection equivalent to that afforded by EU law.

Statistics:

  • EU-US data transfer frameworks have been in place since July 10, 2023.
  • The CJEU has issued rulings in Schrems I (2015) and Schrems II (2020), invalidating previous adequacy decisions regarding the US.
  • US Executive Order (10 October 2022) and Attorney General Regulation (7 October 2022) strengthened privacy safeguards for intelligence agencies in the US.

Sources:

  • Charter of Fundamental Rights of the European Union (2000) – C 364/01
  • Treaty on the Functioning of the European Union (2007) – OJ L 235/1
  • EU secondary legislation – see Official Journal of the European Union
  • European Commission, Adequacy decision on the EU-US data transfer framework (10 July 2023)
  • Court of Justice of the European Union, Judgment in Schrems I (2015)
  • Court of Justice of the European Union, Judgment in Schrems II (2020)
  • US Executive Order (10 October 2022)
  • US Attorney General Regulation (7 October 2022)