EU-US data transfers: Risk set to reduce as EU issues draft adequacy decision

3 mins

Posted on 15 Dec 2022

EU-US data transfers: Risk set to reduce as EU issues draft adequacy decision

EU–US Data transfers: Draft adequacy decision published

On 13 December 2022, the European Commission issued a draft adequacy decision for data flows between the US and EU.


Any international transfers of personal data under the GDPR (adopted in the UK via the UK GDPR) need to ensure the third country (the country to which the data is transferred) has adequate levels of data protection. This requires either an “adequacy decision” or another appropriate safeguard.

Previously, data transfers between the EU and US were permitted if they followed the mechanisms in the EU-US Privacy Shield. However, the Privacy Shield was ruled invalid in July 2020 by the European Court of Justice in the “Schrems II” case.

Since July 2020, data transfers between the EU and US have required alternative safeguards (for example, Standard Contractual Clauses or Binding Corporate Rules). The Schrems II Ruling also outlined that additional safeguards are needed when relying on Standard Contractual Clauses.

Draft adequacy decision

The draft decision issued by the EU concludes that the US framework provides comparable safeguards to those in the EU. US organisations will be permitted to join the EU-US Data Privacy Framework (the “Framework”) if they commit to complying with a detailed set of privacy obligations. For example, personal data will need to be deleted when it is no longer necessary for the purpose for which it was collected, and protection of data must continue when personal data is shared with third parties. There will be new redress avenues for EU citizens if their data is handled in a way that does not comply with the Framework.

This development will be welcomed by both controllers in the EU and the US as it would allow a smoother transition of data between the countries.

Next steps

The draft adequacy decision will now be sent to the European Data Protection Board (EDPB) for its opinion. Afterwards, the Commission will seek approval from a committee composed of representatives of the EU Member States. The European Parliament may also scrutinise any draft adequacy decision. Once this procedure is completed, the Commission can adopt its final adequacy decision.

If approved, the Framework will be subject to periodic reviews. These will be carried out by the European Commission, together with European data protection authorities, and the competent US authorities. The first review will take place within one year after the adequacy decision comes into force.

How does this impact the UK?

While the draft adequacy decision is for EU-US data transfers, the UK will likely be keeping a very keen eye on developments. If an adequacy decision is adopted, via the Framework, for data transfers between the EU and US, it is likely the UK will seek a similar arrangement for UK–US data transfers, as the UK has a similar data protection regime under the UK GDPR. 

If you require any assistance on data transfer arrangements, please contact our Data Protection specialists below.

Piers Leigh-Pollitt

Piers advises a mixture of corporates and individuals on a wide range of HR/employment law matters and data protection issues (mainly from an HR perspective). Piers is also the firm’s internal compliance officer and handles all regulatory and internal compliance matters. He also heads up the firm's Data Privacy team and holds the Practitioner Certificate in Data Protection (GDPR).

  • Partner & Compliance Officer for Legal Practice
  • T: +44 (0)118 951 6761
  • Email me

View profile

Mike Hibberd

Mike is an employment and data privacy law expert advising both organisations and senior individuals on a wide range of human resources and related issues.

  • Legal Director
  • T: +44 (0)118 951 6765
  • Email me

View profile

The articles published on this website, current at the date of publication, are for reference purposes only. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your own circumstances should always be sought separately before taking any action.

Back to top