The GDPR imposes stricter requirements on the transfer of personal data to third countries outside the EU. However, such transfers are often less problematic if they are based on an adequacy decision issued by the European Commission, provided that any additional requirements stipulated in the corresponding adequacy decision are also met.<\/p>\n\n\n\n
Companies (in Germany) often use adequacy decisions issued by the European Commission as a basis for the transfer of personal data to the USA. These decisions mostly concern agreements between the EU and the USA. Following the ECJ rulings Schrems I and II, which overturned the \u201cSafe Harbor\u201d and \u201cPrivacy Shield\u201d agreements, the EU made improvements in 2023 and developed the \u201cData Privacy Framework\u201d (Decision (EU) 2023\/1795) with the USA. The Data Privacy Framework created a new legal basis for transatlantic data transfers and implemented additional protection mechanisms in the USA, such as the Data Protection Review Court.<\/p>\n\n\n\n
A challenge to the validity of the European Commission\u2019s adequacy decision on the Data Privacy Framework was lodged with the General Court of the European Union (GC) by a French applicant (Case T-553\/23). The applicant petitioned the GC to declare the Data Privacy Framework null and void, citing, in particular, the following reasons:<\/p>\n\n\n