The Commission has today published a report following the first review of the adequacy decision for the EU-US data protection framework with regard to personal data transferred from the European Union to organizations in the US.

Based on the information gathered during the review, the Commission concludes that the US authorities have implemented all the components of the framework.

This includes implementing safeguards to limit US intelligence authorities’ access to personal data to what is necessary and proportionate to protect national security, and establishing an independent and impartial appeals mechanism.

The report also contains a number of recommendations to ensure that the framework continues to work effectively, such as the development of joint guidance between US and EU data protection authorities on the core requirements of the framework for data protection. The Commission will continue to monitor developments and submit periodic reports on its operation.

The review is based on input from a wide range of actors, including civil society organisations, trade associations, EU data protection authorities, US authorities involved in the implementation of the framework, as well as public comments received through the Have Your Say portal your”.

The report is also based on the information gathered during the July 2024 review meeting between Justice Commissioner Didier Reynders, US Commerce Secretary Gina Raimondo, and their experts. The EU delegation at the review meeting included representatives of the European Commission and the European Data Protection Board.

Lena Flitzani