New data transfer adequacy decision for the transfer of data between the United States and EU

As a reminder

Following the invalidation of the Privacy Shield adequacy decision by the Court of Justice of the European Union on 16 July 2020, the transfer of personal data from the European Union Member States to the United States was no longer possible. The transfer of data to countries outside of the European Union cannot be freely effectuated and must be the subject of an adequacy decision (such as for the United Kingdom or South Korea). They are only authorised if the country provides the transfered data an adequate level of protection in order to guarantee that the level of protection of European citizens’ data is not compromised.

The new adequacy decision between the United States and the EU

On 10 July 2023 (also the date of its entry into force), the European Commission adopted an adequacy decision in favor of the United States, henceforth allowing the transfer of data in compliance with the GDPR’s provisions. The Commission effectively deemed that the United States’s recent legislative amendments (in particular concerning the American authorities’ access to the data) ensure an adequate level of protection for the data transferred to the United States. Nonetheless, American organisations receiving such data on American soil must commit to complying with the principles stated and which will be listed on the United States Department of Commerce’s website.