We missed this earlier: At long last, the European Union (EU) is inching towards finalising a framework for "safe" personal data flows between the bloc and the United States (US). A draft "adequacy decision"—a tool that basically allows data transfers from the EU to countries with comparable data protection laws—was forwarded to the European Data Protection Board for comments, said a December 13th European Commission press release. It concluded that "the United States ensures an adequate level of protection for personal data transferred from the EU to US companies". Why does it matter?: "Once the adequacy decision is adopted, European entities will be able to transfer personal data to participating companies in the United States, without having to put in place additional data protection safeguards," explains the European Commission. What's new?: US companies can join the framework by committing to comply with specific privacy measures—like deleting data when no longer necessary, and protecting personal data that's shared with third-parties. "Access to European data by US intelligence agencies will be limited to what is necessary and proportionate to protect national security," adds the press release. More grievance redressal mechanisms are on the cards, including independent dispute resolution mechanisms and an arbitration panel. EU citizens can also approach an independent court proposed by the US to challenge collection and use of their data by US intelligence agencies. Why this is happening—remember Schrems II from 2020?: That's when the EU's Supreme Court invalidated data transfers between the EU and US under "Privacy Shield". Privacy Shield was an EU-US joint…
