On 10 July 2023, the European Commission introduced a new adequacy decision under the EU-US Data Privacy Framework. This decision is a response to the challenges posed by the so-called Schrems II ruling from 2020, which invalidated the Privacy Shield framework. The ruling made it difficult to transfer data from the EU to the USA under GDPR.
US measures
In response to this challenge, the USA adopted an executive order in October 2022, which introduced stronger protections for European citizens' data. However, it is important to note that an executive order is not a permanent solution and can be changed by future administrations.
After a review period, the European Commission considered these changes in US legislation sufficient, leading to the new adequacy decision.
New decision by the European Commission
Despite the European Commission's new adequacy decision, uncertainty remains, especially considering that US authorities still have the right to request personal data from US cloud services within the EU. Experts and critics, such as Max Schrems from the organisation NOYB, point out that the fundamental problems with US surveillance legislation remain.
“We have now had ‘Harbors’, ‘Umbrellas’, ‘Shields’ and ‘Frameworks’ – but no substantial change in US surveillance law.” - Max Schrems
