EU – US Privacy Shield adequacy decision incorporated into the EEA Agreement

On 12 July 2016 the European Commission adopted an "adequacy decision" allowing for the transatlantic transfer of personal data from the EU to the US in accordance with the framework and principles of the EU-US Privacy Shield (the "Privacy Shield"). This new framework was established following the previous transfer mechanism, the US Safe Harbour, being found invalid by the ECJ in October 2015.

On 7 July 2017, the adequacy decision was incorporated into the EEA Agreement through a decision of the European Economic Area (EEA) Joint Committee. This formally extends the Privacy Shield framework to Iceland, Liechtenstein and Norway with effect from 8 July 2017, subject to any necessary EEA Agreement notifications.

Whilst the Privacy Shield has operated for approximately one year and currently has over 2,300 participating US organisations, two privacy advocacy groups have filed actions in the European General Court to annul the adequacy decision, arguing that the Privacy Shield does not provide an adequate level of protection for EU citizens’ rights under EU law where their data is transferred to the US. The European Parliament has also adopted a non-legislative resolution on the adequacy of the protection afforded by the Privacy Shield. The first annual joint review into the Privacy Shield will be conducted by the Commission and the US Department of Commerce in September 2017, following which the Commission will issue a public report to the European Parliament and the Council of the EU.

The decision of the EEA Joint Committee No.144/2017 can be found here.