Iubenda logo
Start generating

Documentation

Table of Contents

Green Light for the Data Privacy Framework: EU to US Personal Data Transfers Now Approved 

On July 10, 2023, the European Commission made a significant announcement by adopting its adequacy decision on the EU-US Data Privacy Framework (DPF). 

This decision signifies that the United States is once again recognized as providing an adequate level of protection to its European Union (EU) counterpart. Consequently, personal data can now flow freely from the EU to US self-certified companies without the need for additional safeguards

This article will delve into the details of the decision and highlight the key revisions made to the invalidated Privacy Shield framework.

  • July 2000: The European Commission adopted the decision on the adequacy of the protection provided by the Safe Harbour privacy principles.
  • October 2015: Safe Harbour was invalidated further to the first Schrems decision issued. 
  • July 2016: The European Commission adopted the decision on the adequacy of the protection provided by the EU-US Privacy Shield.
  • July 2020: The Court of Justice of the European Union (CJEU) declared the EU-US Privacy Shield as incompatible with GDPR and, therefore, no longer valid
  • March 2022: President von der Leyen and President Biden reached an agreement in principle on a new trans-Atlantic Data Privacy Framework.
  • October 2022: President Joe Biden signed executive order 14086 on Enhancing Safeguards for United States Signals Intelligence Activities. 
  • December 2022: The European Commission adopted its draft adequacy decision on the EU-U.S. Data Privacy Framework.
  • February 2023: The European Data Protection Board adopted its opinion on the draft adequacy decision.
  • May 2023: Non-binding resolution of the European Parliament was issued.
  • July 2023: Nearly all EU Member States representatives approved the draft adequacy decision.
  • July 2023: The European Commission formally adopted its adequacy decision on the EU-U.S. Data Privacy Framework.

The French data protection authority, CNIL (Commission nationale de l’informatique et des libertés), has issued an FAQ document concerning the European Commission’s adequacy decision regarding the EU-U.S. Data Privacy Framework. Within this FAQ, CNIL outlines the essential provisions of the DPF and provides guidance on how French organizations can transfer data to U.S. entities in cases where the latter have not adopted the DPF agreement. Such transfers can be achieved through mechanisms such as SCCs (Standard Contractual Clauses) or any other method specified under Article 46 of the GDPR.

Furthermore, CNIL emphasizes the importance of data exporters undertaking an impact analysis of data transfers (referred to as AITD or TIA) to determine, on a case-by-case basis, whether they meet the level of protection mandated by European Union law.

EU-US Data Privacy Framework

The EU-US DPF marks a crucial step towards reinstating trust and confidence in transatlantic data transfers. 

After the Schrems II judgment by the CJEU, the previous Privacy Shield framework was invalidated due to concerns over access to data by US intelligence agencies. 

The newly adopted framework addresses these concerns through several notable revisions:

1. Necessary and Proportionate Access to Data

Under the EU-US DPF, access to data by US intelligence agencies is now limited to what is deemed “necessary and proportionate.

This provision ensures that data transfer complies with stringent privacy standards while balancing legitimate national security interests.

2. Two-Layer Redress Mechanism

To enhance accountability and protect the rights of EU individuals, a new two-layer redress mechanism has been established.

  1. The first layer consists of a Civil Liberties Protection Officer (CLPO) from the US intelligence community, who independently and objectively investigates complaints submitted by EU individuals, free of charge and in their own language directly to the data protection authorities of their countries. These complaints are then transmitted by the European Data Protection Board to the US.
  2. The second layer comprises the Data Protection Review Court (DPRC), which acts as an independent and binding authority. The DPRC hears appeals against decisions made by the CLPO. Importantly, the DPRC members possess specific qualifications and operate outside the US government’s influence or instructions, ensuring impartiality and fairness.

3. Empowering EU Individuals

The adequacy decision grants EU individuals whose data has been transferred to self-certified US companies several important rights. These rights include the ability to:

  1. access their data;
  2. request corrections; 
  3. delete incorrect or unlawfully handled data, and 
  4. access redress avenues through a free-of-charge independent dispute resolution mechanism and an arbitration panel.

4. Wider Applicability and Safeguards

The safeguards provided by the US government within the EU-US DPF extend beyond data transferred through this specific framework. They also apply to data transferred via other mechanisms, such as:

  • standard contractual clauses; or 
  • binding corporate rules. 

This broader application ensures a consistent level of data protection for EU individuals, regardless of the specific transfer mechanism utilized.

5. Periodic Reviews and Continuous Compliance Monitoring

To ensure ongoing compliance and effectiveness, the EU-US DPF will be subject to periodic reviews. 

The first review is scheduled to take place within a year from the framework’s entry into force. The European Commission will continuously monitor relevant developments in the US to ensure that the established safeguards are maintained.

Further to its last plenary meeting, the EDPB has adopted an information note for both individuals and entities carrying out data transfers to the U.S., which clarifies that no supplementary measures are required for transfers based on the adequacy decision. However, transfers to U.S. entities not included on the ‘Data Privacy Framework List’ require additional safeguards, such as SCCs or BCRs. The information note further reaffirms that EU individuals can submit a complaint to their national data protection authority to make use of the new redress mechanism regardless of the transfer tool used to transfer personal data to the U.S.

What do you need to do now? 

Currently, there is no immediate action required. We need to wait for US companies to complete the self-certification process before data flows can begin.

The adoption of the EU-US Data Privacy Framework by the European Commission represents a significant milestone in transatlantic data privacy. With the adequacy decision in place, the flow of personal data from the EU to US companies can resume without additional safeguards, provided they participate in the EU-US DPF. 

The companies listed at this this link under the tab “Active” are the ones that have already self-certified for compliance with the new DPF (EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, or both as specified under “Framework”).

Using Google Analytics or any affected services? Remember to include them in your privacy policy.

Update your Privacy Policy