On 13 December 2022, approximately only 1 month after the signing of President Biden’s Executive Order, the European Commission announced the Draft Adequacy Decision for EU – US Data Transfers.
This time-record achievement officially launches the process towards the adoption of the Adequacy Decision for the proposed EU-US Data Privacy Framework, and may put a preliminary end to the period of legal uncertainties relating to the daily (and sometimes essential) transatlantic data transfers operated by EU’s businesses.
For years, the use of many essential US-based services (e.g. SalesForce or Microsoft) has been constantly criticized and even declared unlawful in Europe, following the well-known Schrems II Judgment that exposed the insufficient level of data protection guaranteed by the US legal framework, in particular linked to the extensive surveillance powers of the US intelligence agencies.
However, the adoption process of the Decision is only in its early stages and this news, despite being a hopeful step towards a final resolution to the problem, does not change the current Opinions of the EDPB and the European Authorities concerning US data transfers.
For the Draft Decision to become effective, we still have to wait:
- The (non-binding) EDPB’s Opinion;
- The approval by representatives of the EU Member States;
- The adoption of the final Adequacy Decision by the Commission.
The process usually takes approximately 6 months but, as we have seen in this initial stage, EU Institutions seem to be prioritizing the resolution of this matter.
Until completion of the adoption process, EU companies shall continue to base EU – US data transfers on the new SCCs model, supported by the additional measures deemed necessary, or on different appropriate tools. We have supported our clients over the last months to update the old contract to the new SCC model-clauses and meet the deadline of December 27th 2022.
Which are the possible scenarios?
As mentioned above, the European Institutions seem to have prioritized the management of this problem. Currently, the most likely scenario foresees the final adoption of the Adequacy Decision by the European Commission. However, considering the critics that have been voiced against Biden’s Executive Order over the past weeks, it is possible that the eventual Adequacy Decision could face opposition and possibly result in a “Schrems III”, that would invalidate the transfers once again.
Nevertheless, the decision-making process is only at the beginning and future scenarios may vary widely, depending on the EDPB’s opinion and the eventual amendments proposed to the document.
Careful monitoring of the adoption process remains imperative in order to predict the most likely outcomes and to continue to properly regulate EU – US data transfers.