§ 01
Definition
It replaced Privacy Shield, which the Court of Justice invalidated in the 2020 Schrems II judgment over US surveillance concerns. US companies self-certify with the US Department of Commerce and commit to its privacy principles.
§ 02
How it works
The framework relies on US Executive Order 14086, which added limits on signals intelligence and created a redress mechanism for Europeans. In September 2025 the EU General Court dismissed a challenge to it (Latombe v Commission); further legal challenges remain possible.
§ 03
Why it matters
Many VPN providers, payment processors and analytics tools are US companies or use US infrastructure. The framework is the legal basis for much of that data transfer, and its stability affects how 'EU-friendly' a US service really is.