EU-US Data Privacy Framework: new safeguards for the transfer of personal data to the USA

On 10 July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework ensuring that the United States of America guarantees an adequate level of protection of personal data comparable to that of the European Union.

The adequacy decision is one of the tools provided for by Regulation (EU) 2016/679 (the ‘Regulation’) to transfer personal data from the European Union to third countries that, upon prior assessment by the European Commission, offer ‘an adequate level of protection’, i.e. a level of protection of personal data equivalent to that guaranteed within the EU.

The consequence is that personal data can be transferred securely and can be managed in the same way as data transmissions that take place within Europe.

What does the new EU-US Data Privacy Framework entail?

The EU-US Data Privacy Framework is structured around a self-certification mechanism whereby US companies undertake to comply with a number of personal data protection obligations, including, but not limited to, compliance with the principles of purpose limitation, data minimisation and retention, as well as specific obligations regarding data security and data sharing with third parties.

The organisations’ undertakings will be renewed on an annual basis and are subject to checks and monitoring by the U.S. Department of Commerce, which will process certification applications and periodically verify compliance with the requirements by participating companies.

European citizens will benefit from several independent and impartial remedies in the event that their data is processed in a non-compliant manner, including the newly established Data Protection Review Court (DPRC).

US law will provide a number of safeguards, including limiting access to personal data by public authorities to what is necessary and proportionate to protect national security or to enforce criminal law.

In any case, the Data Privacy Framework will be subject to periodic revisions by the European Commission together with representatives of the European data protection authorities and the competent US authorities.  The first review will take place within one year of the entry into force of the adequacy decision.

The other instruments provided for by the Regulation

It is worth remembering that in addition to the adequacy decision, the Regulation also provides for other tools to ensure the correct transfer of data outside the European Union, including:

• the adoption of Standard Contractual Clauses;
• the adoption of Binding Corporate Rules (BCR) by large international groups following negotiations with the supervisory authorities of the countries involved;
• adherence to specific Codes of Conduct or, in any case, to certification mechanisms which must be simultaneously applied by the entity to whom the data are transferred;
• the consent of the data subject who must be adequately informed as required by the Regulation itself.

◊◊◊◊

As most recently pointed out in the information note of the European Data Protection Board (EDPB) of 18 July 2023, all the protections provided by the US government in the field of national security apply to all transfers of personal data made to companies in the United States, regardless of the transfer mechanisms used. Therefore, these guarantees also serve to facilitate the use of the other instruments provided for by the Regulation.

Other related insights:

• DID YOU KNOW THAT… The European Commission and the US reached a framework agreement on the transfer of personal data? De Luca & Partners (delucapartners.it)
• Privacy Shield: the Court of Justice of the European Union invalidates the EU – USA Agreement – De Luca & Partners (delucapartners.it)