Insights

London – June 11, 2026: Crowell & Moring Partner Emma Wright has been appointed to the UK Government's newly formed Digital ID Advisory Group, an independent body of experts convened by Right Honorable Darren Jones MP, to support the delivery of a national digital ID system that is inclusive, useful, and trusted. 

Washington – June 4, 2026: Crowell & Moring earned 92 individual rankings for 81 attorneys, as well as 48 national and statewide practice area rankings, in the Chambers USA 2026 guide. The Chambers guide ranks the country’s top law firms and lawyers through in-depth research, client interviews, and feedback from attorneys at peer firms. 

Washington – June 6, 2024: Crowell & Moring earned 78 rankings for 67 lawyers, as well as 41 national and statewide practice area rankings, in the Chambers USA 2024 guide. The rankings are driven by independent interviews of clients and lawyers at peer firms.

The EU Cyber Resilience Act (CRA) is an EU product cybersecurity law for connected products (formally, “products with digital elements” under the CRA) commercialized in the EU; it entered into force on 10 December 2024, with direct application across the EU. Full application begins 11 December 2027, but one of its most operationally demanding provisions takes effect in just under 100 days, on 11 September 2026: the mandatory vulnerability and incident reporting under Article 14 CRA.

The flow of data across borders is essential to our global economy. As companies grow more and more dependent on cross-border data transfers to conduct business, two parallel legal trends have emerged:

In a move that underscores the evolving landscape of global data governance, China announced a new initiative aimed at fostering cross-border data flows. On November 17, Chinese President Xi announced the launch of a “Global Cross-Border Data Flow Cooperation Initiative” while attending the Asia Pacific Economic Cooperation (APEC) leaders meeting in Lima, Peru. The following day, the Cyberspace Administration of China released further details about the initiative, which frames China as a proponent of non-discriminatory and cooperative data policies. However, closer analysis reveals a complex interplay of geopolitical, economic, and regulatory factors behind this initiative.

On July 10, 2023, the European Commission formally adopted a new adequacy decision for the EU-U.S. Data Privacy Framework (DPF), which provides companies transferring personal data to the U.S. an additional mechanism to legitimize their cross-Atlantic data transfers. The DPF replaces the previously invalidated Privacy Shield and Safe Harbour framework. The DPF is in many ways a “Safe Harbour III” – mainly due to the way that organizations can adhere to it, how it is administered, and the way that its compliance is monitored. However, the legal framework in the U.S. did change to accommodate the requests from the EU and the concerns expressed in the CJEU’s Schrems I and II judgments (reflected in the Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities of October 7, 2022 and regulations adopted by the U.S. Attorney General).

Please join Crowell & Moring for another episode in our webinar series discussing the transfer of personal data and data localization laws across the globe. Attorneys from our global network of offices will provide insights into data transfers in the U.S., the UK, the EU, broader Europe, and Asia-Pacific.

Please join Crowell & Moring for the second of a three-part webinar series discussing the transfer of personal data and data localization laws across the globe. Attorneys from our global network of offices will provide insights into data transfers in the U.S., the UK, the EU, and Asia-Pacific.