The European Union has recently approved a new transatlantic data adequacy agreement with the United States. This decision resolves the legal uncertainty surrounding the export of EU users’ personal data by US companies, which has affected numerous businesses, including high-profile examples such as Meta and Google. EU justice commissioner Didier Reynders spoke confidently during the announcement, stating that this third agreement granted by the EU will ensure the free and secure flow of personal data from the European Economic Area to the United States without additional conditions or authorizations. Reynders emphasized that this adequacy decision guarantees a stable and trusted arrangement that protects individuals and provides legal certainty to companies. Although the political agreement on the EU-U.S. Data Privacy Framework (DPF) was announced in March 2022, it took over a year to finalize all the details. The previous mechanism for simplifying data exports was invalidated by EU judges three years ago. Therefore, the adoption of this new adequacy deal brings an end to years of legal uncertainty for major US cloud services and other digital players. However, the durability of this third agreement remains uncertain, and it may face legal challenges in the future. Previous arrangements, Safe Harbor and Privacy Shield, were invalidated by the EU’s top court due to concerns about the protection of personal data against US surveillance powers. Privacy campaigners are warning that the new framework may also face scrutiny from the Court of Justice of the European Union (CJEU). One of the main concerns is the lack of reform in US surveillance powers since the demise of Privacy Shield. The DPF attempts to address these issues but may still fall short of delivering the necessary protection for data privacy when it is transferred to the US. The Commission’s decision to adopt the adequacy agreement is not final, and legal challenges, including one from privacy campaign group noyb, are expected. It is unclear how long the process will take, but it could be years before a final verdict is reached by the CJEU. Despite the criticisms, the EU and US negotiating teams claim that the new framework includes significant changes and improvements, particularly regarding the US legal framework and redress mechanisms. The EU argues that the new framework ensures compliance with EU court rulings and provides enforceable safeguards for data privacy.
