After several years of attempts to regulate joint relations regarding the transfer of personal data between EU and the USA, the European Commission has on July, 10th 2023, brought the so-called decision on adequacy by which it was decided that the USA ensures an adequate level of personal data protection, i.e. that it provides a level of personal data protection that is basically the same as that provided in the EU.

With this, the US joined the list of countries to which personal data can be freely transferred from the EU (as well as Norway, Liechtenstein and Iceland) without additional obstacles, which list includes Andorra, Argentina, Canada (commercial organizations only), the Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom and Uruguay.

Based on an adequacy decision, personal data can be securely transferred from the EU to companies in the US that participate in the Data Privacy Protection Framework, without the need to introduce additional data protection measures. The list of organizations included in the new framework can be found at the following link.

In the event of a suspected data breach, EU individuals will have available several appropriate means of legal protection, including free of charge independent dispute resolution mechanisms and an arbitral tribunal.