Worldwide: Adequacy Decision For The EU-U.S. Data Privacy Framework

The European Commission has adopted an adequacy decision for the EU-U.S. Data Privacy Framework ("DPF"). This means that personal data can now be transferred from EU to U.S. organisations certified under the framework without the need for additional data protection and security measures.

The new framework addresses concerns raised by the European Court of Justice in relation to the Schrems II case (C-311/18). It introduces restricted access to EU data by U.S. intelligence services to what is necessary and proportionate. Additionally, a Data Protection Review Court ("DPRC") has been established, granting EU individuals access to independent redress mechanisms.

The DPF also requires U.S. organisations to commit to a detailed set of privacy obligations, such as deleting personal data when it is no longer necessary and ensuring continuity of protection when sharing data with third parties.

To ensure continuous effectiveness, the EU – U.S. DPF will undergo periodic reviews conducted by the European Commission, European data protection authorities, and competent U.S. authorities. The first review will take place within a year of the adequacy decision's entry into force.

Regarding onward transfers of data, the Accountability for Onward Transfer Principle imposes obligations on EU-U.S. DPF certifed organisations. These organisations must adhere to limited and specified purposes when transferring personal data to third-party controllers or processors. The third party must provide the same level of protection as guaranteed by the framework.

While critics have already argued that the EU-U.S. DPF will not be sufficient to cater for the fundamental rights of privacy of EU citizens and it can likely be expected that it will be challenged, the EU-U.S. DPF establish a valid legal transfer mechanism and a basis for complying with Chapter V of the GDPR.

We are now awaiting to see US organisations announce their completed self-certification under the EU-U.S. DPF.

Read the press release, adequacy decision and Q&A from the EU Commission here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.