In March 2022, the European Commission and the U.S. government announced the political agreement on a new EU-U.S. Data Privacy Framework to replace the Privacy Shield Framework which had been struck down by the CJEU in the case of Schrems II. The new framework seeks to establish the legal basis for transatlantic data flows to enable U.S. companies to comply with EU data protection law while still being subject to U.S. foreign intelligence surveillance laws. Following the implementation of the new U.S. commitments under the agreed framework into U.S. law, the European Commission published a Draft Implementing Decision on the adequacy of the level of protection by the U.S. In line with Article 70(i)(s) GDPR, the European Data Protection Board provided the Commission with an opinion for the assessment of the adequacy of the level of protection in the U.S. and recommends some clarifications in order to solidify the grounds for the
Draft Decision and to ensure a close monitoring of the concrete implementation of this new legal
framework in particular as regards the safeguards it provides. Sandra’s report in the European Data Protection Law Review summarises the main comments and concerns expressed by the EDPB and provides a brief outlook on the fate of the Draft Decision.
