On July 10, 2023, the European Commission (“Commission”) adopted an adequacy decision for the EU-US Data Privacy Framework (“DPF”). The DPF is the successor to the EU-US Privacy Shield, which the Court of Justice of the European Union (“CJEU”) declared invalid in 2020.
This adequacy decision reflects agreement by the Commission that the DPF offers an adequate level of protection for personal data transferred from the European Union to the United States under Article 45(1) of the General Data Protection Regulation. Moreover, the DPF entered into force upon adoption of the adequacy decision yesterday. This means that US businesses certified under the DPF no longer require separate data transfer mechanisms in order to transfer personal data from the European Union to the United States.