The Next Phase of Privacy Shield

Jun 16, 2022 by Rebecca Knight, CIPP/E, CIPP/US, Counsel, Policy Privacy Initiatives, BBB National Programs

On March 25, 2022, the EU Commission and the US announced they had agreed, in principle, on a new Trans-Atlantic Data Privacy Framework (TADPF). The announcement of TADPF begins to lift the cloud of uncertainty that has been hanging over Privacy Shield for nearly two years since the July 2020 Court of Justice of the European Union’s Schrems II judgment. Additionally, TADPF serves as a foundation for a US adequacy decision reinstituting trans-Atlantic data flow. 

As BBB National Programs’ Global Privacy Division continues to prepare for this next phase of Privacy Shield, we want to highlight several key details regarding the substance of TADPF and the EU’s adequacy decision process.


The Substance 

The details are still being hashed out, but so far, we know TADPF will include the following commitments:  

  1. Strengthening individual privacy and civil liberties safeguards by limiting access to data by US intelligence agencies to what is necessary and proportionate for national security. 
  2. The establishment of an independent and binding multi-layered redress mechanism, which will include a Data Protection Review Court composed of individuals outside of the US, to adjudicate claims and direct remedial measures.
  3. The adoption of oversight procedures by US intelligence agencies to ensure privacy is strengthened and civil liberties safeguards are maintained.  


Notably, these commitments all fall squarely on the US government to implement. The lift seems to be much lighter for businesses.  

As reported, it appears the commercial data protection obligations, Privacy Shield Principles, and even the name Privacy Shield will remain the same. As such, it is anticipated that businesses currently certified under Privacy Shield will remain certified once TADPF receives an adequacy decision, eliminating the need to complete the certification process again.  


The Adequacy Process  

As indicated by the March 25 joint announcement and accompanying fact sheet, the return of Privacy Shield through TADPF will be effectuated through an Executive Order and requires no legislative action. And according to a recent report, the Executive Order is expected later this month (June 2022). After the Executive Order is signed, there will be a need to complete the EU’s adequacy process.  

This process is completed in five distinct steps:  

  1. EU Commission drafts an adequacy determination and provides it to the European Data Protection Board (EDPB) for review. 
  2. EDPB reviews the adequacy determination and issues a non-binding opinion.
  3. European Parliament can adopt a non-binding resolution of its position.
  4. EU Member States must approve. 
  5. Finally, if approved by the Member States, the adequacy determination will be adopted and take immediate effect.  


Based on previous adequacy decisions, if the Executive Order is signed this month as anticipated, the process for the return of Privacy Shield could be completed by the end of the year. For example, after Schrems I and the invalidation of Safe Harbor on October 6, 2015, Privacy Shield was announced on February 2, 2016. The Privacy Shield legal documents were published on February 29, 2016, and the EU Commission’s adequacy decision was provided and took effect on July 12, 2016 – a period of approximately five months. Similarly, the UK’s adequacy process was completed in four months, beginning on February 19, 2021, and ending on June 28, 2021.  


Our Promise to You 

Undoubtedly, the return of Privacy Shield will present a number of questions. But the Global Privacy Division is here to help. In fact, we have never stopped serving as an independent resource for businesses and consumers with data privacy concerns. 

Over the past two years, BBB EU Privacy Shield has continued to maintain our Independent Recourse Mechanism (IRM) program, ensuring businesses remained in compliance with the GDPR. If you have questions for us about this next phase of Privacy Shield, whether you are a current, previous, or prospective Privacy Shield participant, let us know here.   

Suggested Articles


American Privacy Rights Act: A Primer for Business

Was it the recent series of natural phenomena that prompted Congress to move on a bipartisan, bicameral federal privacy bill? We can’t say with certainty, but we can outline for you what we believe to be, at first glance, the most compelling elements of the American Privacy Rights Act of 2024 (APRA).
Read more

Take Care of Your “Health-Lite” Claims

Some advertisers believe they can avoid scrutiny when making health-related claims by making their claim “softer.” But context is key. Health benefit claims must comply with the FTC’s Health Products Compliance Guidance. The substantiation bar is not lowered by changing the approach to the health-related claim.
Read more

Bullish but Cautionary: A Balanced Way to Approach the Impact of AI

Business and nonprofit leaders in the U.S. may not feel so weighty a responsibility in assessing the global impact of AI, but we must realize AI’s power to impact our organizations, our local economies, our sectors, and our nation.
Read more

New Rules of the Road Can Sustain US Leadership on Interoperable Digital Data Flows

President Biden closed February 2024 with an EO that signaled an important development for how the U.S. plans to position and guard itself from global adversaries, and speaks volumes about how the U.S. views the next-generation impacts of data flows on the digital economy and how our nation can be better equipped as a global leader. Read our takeaways and future considerations.
Read more