On July 10, 2023, the European Commission made a significant announcement by adopting its adequacy decision on the EU-US Data Privacy Framework (DPF).
This decision signifies that the United States is once again recognized as providing an adequate level of protection to its European Union (EU) counterpart. Consequently, personal data can now flow freely from the EU to US self-certified companies without the need for additional safeguards.
This article will delve into the details of the decision and highlight the key revisions made to the invalidated Privacy Shield framework.
- EU-US Data Privacy Framework: The Background
- EU-US Data Privacy Framework
- What do you need to do now?
EU-US Data Privacy Framework: The Background
- July 2000: The European Commission adopted the decision on the adequacy of the protection provided by the Safe Harbour privacy principles.
- October 2015: Safe Harbour was invalidated further to the first Schrems decision issued.
- July 2016: The European Commission adopted the decision on the adequacy of the protection provided by the EU-US Privacy Shield.
- July 2020: The Court of Justice of the European Union (CJEU) declared the EU-US Privacy Shield as incompatible with GDPR and, therefore, no longer valid.
- March 2022: President von der Leyen and President Biden reached an agreement in principle on a new trans-Atlantic Data Privacy Framework.
- October 2022: President Joe Biden signed executive order 14086 on Enhancing Safeguards for United States Signals Intelligence Activities.
- December 2022: The European Commission adopted its draft adequacy decision on the EU-U.S. Data Privacy Framework.
- February 2023: The European Data Protection Board adopted its opinion on the draft adequacy decision.
- May 2023: Non-binding resolution of the European Parliament was issued.
- July 2023: Nearly all EU Member States representatives approved the draft adequacy decision.
- July 2023: The European Commission formally adopted its adequacy decision on the EU-U.S. Data Privacy Framework.
EU-US Data Privacy Framework
The EU-US DPF marks a crucial step towards reinstating trust and confidence in transatlantic data transfers.
After the Schrems II judgment by the CJEU, the previous Privacy Shield framework was invalidated due to concerns over access to data by US intelligence agencies.
The newly adopted framework addresses these concerns through several notable revisions:
1. Necessary and Proportionate Access to Data
Under the EU-US DPF, access to data by US intelligence agencies is now limited to what is deemed “necessary and proportionate.”
This provision ensures that data transfer complies with stringent privacy standards while balancing legitimate national security interests.
2. Two-Layer Redress Mechanism
To enhance accountability and protect the rights of EU individuals, a new two-layer redress mechanism has been established.
- The first layer consists of a Civil Liberties Protection Officer (CLPO) from the US intelligence community, who independently and objectively investigates complaints submitted by EU individuals, free of charge and in their own language directly to the data protection authorities of their countries. These complaints are then transmitted by the European Data Protection Board to the US.
- The second layer comprises the Data Protection Review Court (DPRC), which acts as an independent and binding authority. The DPRC hears appeals against decisions made by the CLPO. Importantly, the DPRC members possess specific qualifications and operate outside the US government’s influence or instructions, ensuring impartiality and fairness.
3. Empowering EU Individuals
The adequacy decision grants EU individuals whose data has been transferred to self-certified US companies several important rights. These rights include the ability to:
- access their data;
- request corrections;
- delete incorrect or unlawfully handled data, and
- access redress avenues through a free-of-charge independent dispute resolution mechanism and an arbitration panel.
4. Wider Applicability and Safeguards
The safeguards provided by the US government within the EU-US DPF extend beyond data transferred through this specific framework. They also apply to data transferred via other mechanisms, such as:
- standard contractual clauses; or
- binding corporate rules.
This broader application ensures a consistent level of data protection for EU individuals, regardless of the specific transfer mechanism utilized.
5. Periodic Reviews and Continuous Compliance Monitoring
To ensure ongoing compliance and effectiveness, the EU-US DPF will be subject to periodic reviews.
The first review is scheduled to take place within a year from the framework’s entry into force. The European Commission will continuously monitor relevant developments in the US to ensure that the established safeguards are maintained.
Further to its last plenary meeting, the EDPB has adopted an information note for both individuals and entities carrying out data transfers to the U.S., which clarifies that no supplementary measures are required for transfers based on the adequacy decision. However, transfers to U.S. entities not included on the ‘Data Privacy Framework List’ require additional safeguards, such as SCCs or BCRs. The information note further reaffirms that EU individuals can submit a complaint to their national data protection authority to make use of the new redress mechanism regardless of the transfer tool used to transfer personal data to the U.S.
What do you need to do now?
Currently, there is no immediate action required. We need to wait for US companies to complete the self-certification process before data flows can begin.
The adoption of the EU-US Data Privacy Framework by the European Commission represents a significant milestone in transatlantic data privacy. With the adequacy decision in place, the flow of personal data from the EU to US companies can resume without additional safeguards, provided they participate in the EU-US DPF.
The companies listed at this this link under the tab “Active” are the ones that have already self-certified for compliance with the new DPF (EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, or both as specified under “Framework”).