Let us recall that on July 16th 2020 the Court of Justice of the European Union ruled that the EU-US Privacy Shield, an agreement which represented the legal framework for the transfer of personal data from the European Union to the United States, was invalidated.

The aforementioned decision had a huge impact on European and domestic economic entities, which did business with the USA, and which, from a legal point of view, were prevented from transferring data to the USA under the most favorable conditions, but rather had to respect significant restrictive provisions for the transfer.

In this sense, subjects had the option of transferring data based on Standard Contractual Clauses, which, through different (but similar) mechanisms, meant further ensuring by the transferor that the data is processed in accordance with the law, and the existance of the authority of the supervisory body to prohibit the transfer if it determines that clauses and prescribed standards cannot be respected. The second option was the transfer of data in “special situations”, which significantly limited the possibilities, but certainly represented an option (consent of the person, necessary transfer for the execution of the contract, transfer for the purpose of submitting, realizing and defending a legal claim and a few other specific situations that are rare in practice ).

Since that moment, the question of adequacy has become the most significant topic in the field of personal data protection in the US.

There were no significant developments from the above-mentioned situation until December 13th 2022, when the European Commission initiated the procedure for adopting a decision that would determine the adequate level of protection of personal data in the USA, after President Biden passed an act on improving protective measures in intelligence activities , which should implement into the US legislation the provisions of the agreement reached between the US and the EU on the legal framework for the processing of personal data, which was reached after a year of negotiations.

The adoption of a final act that would determine the existence of an adequate level of protection of personal data will require an additional review of the proposal by The European Data Protection Board, as well as EU member states, but it is expected that the adequacy on the US side will be confirmed.

The public is speculating how long this decision will last, ie. will we witness a renewed rift between the EU and the US regarding the transfer of personal dana, taking into account the complex spectrum of circumstances that have affected the issue so far.