On July 10, 2023, the European Commission made a significant announcement by adopting its adequacy decision on the EU-US Data Privacy Framework (DPF).
This decision signifies that the United States is once again recognized as providing an adequate level of protection to its European Union (EU) counterpart. Consequently, personal data can now flow freely from the EU to US self-certified companies without the need for additional safeguards.
This article will delve into the details of the decision and highlight the key revisions made to the invalidated Privacy Shield framework.
The French data protection authority, CNIL (Commission nationale de l’informatique et des libertés), has issued an FAQ document concerning the European Commission’s adequacy decision regarding the EU-U.S. Data Privacy Framework. Within this FAQ, CNIL outlines the essential provisions of the DPF and provides guidance on how French organizations can transfer data to U.S. entities in cases where the latter have not adopted the DPF agreement. Such transfers can be achieved through mechanisms such as SCCs (Standard Contractual Clauses) or any other method specified under Article 46 of the GDPR.
Furthermore, CNIL emphasizes the importance of data exporters undertaking an impact analysis of data transfers (referred to as AITD or TIA) to determine, on a case-by-case basis, whether they meet the level of protection mandated by European Union law.
The EU-US DPF marks a crucial step towards reinstating trust and confidence in transatlantic data transfers.
After the Schrems II judgment by the CJEU, the previous Privacy Shield framework was invalidated due to concerns over access to data by US intelligence agencies.
The newly adopted framework addresses these concerns through several notable revisions:
Under the EU-US DPF, access to data by US intelligence agencies is now limited to what is deemed “necessary and proportionate.”
This provision ensures that data transfer complies with stringent privacy standards while balancing legitimate national security interests.
To enhance accountability and protect the rights of EU individuals, a new two-layer redress mechanism has been established.
The adequacy decision grants EU individuals whose data has been transferred to self-certified US companies several important rights. These rights include the ability to:
The safeguards provided by the US government within the EU-US DPF extend beyond data transferred through this specific framework. They also apply to data transferred via other mechanisms, such as:
This broader application ensures a consistent level of data protection for EU individuals, regardless of the specific transfer mechanism utilized.
To ensure ongoing compliance and effectiveness, the EU-US DPF will be subject to periodic reviews.
The first review is scheduled to take place within a year from the framework’s entry into force. The European Commission will continuously monitor relevant developments in the US to ensure that the established safeguards are maintained.
Further to its last plenary meeting, the EDPB has adopted an information note for both individuals and entities carrying out data transfers to the U.S., which clarifies that no supplementary measures are required for transfers based on the adequacy decision. However, transfers to U.S. entities not included on the ‘Data Privacy Framework List’ require additional safeguards, such as SCCs or BCRs. The information note further reaffirms that EU individuals can submit a complaint to their national data protection authority to make use of the new redress mechanism regardless of the transfer tool used to transfer personal data to the U.S.
Currently, there is no immediate action required. We need to wait for US companies to complete the self-certification process before data flows can begin.
The adoption of the EU-US Data Privacy Framework by the European Commission represents a significant milestone in transatlantic data privacy. With the adequacy decision in place, the flow of personal data from the EU to US companies can resume without additional safeguards, provided they participate in the EU-US DPF.
The companies listed at this this link under the tab “Active” are the ones that have already self-certified for compliance with the new DPF (EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, or both as specified under “Framework”).