From Privacy Shield to the Trans-Atlantic Data Privacy Framework

The European Commission pens its draft adequacy determination and transmits it to the European Data Protection Board.

The EDPB issues an opinion, which is not binding on the commission.

• The commission can adjust the draft decision in response to input from the EDPB, Parliament, the Council and other stakeholders and/or consider their feedback as part of subsequent reviews. Major revisions at this stage are unlikely given the length of technical and political negotiations to this point.

The European Parliament, which has no formal role in the adoption process, can adopt a non-binding position in the form of a resolution at any point.

The commission will request approval of a committee composed of Member States representatives.

• The 2016 implementing decision supporting Privacy Shield was adopted by 25 Member States with two abstentions.

The approval requires 55% of EU countries (15 out of 27) representing at least 65% of the total EU population; the blocking minority must include at least four council members representing more than 35% of the EU population.

• This entire process has historically taken several months — five in the case of Privacy Shield in 2016 and four in the case of the U.K. adequacy.

Once greenlit by the Member States, the College of Commissioners will formally adopt the commission decision. The decision will then be published in the EU Official Journal and take immediate effect.