{"id":25187,"date":"2023-08-29T08:09:36","date_gmt":"2023-08-29T06:09:36","guid":{"rendered":"https:\/\/www.delucapartners.it\/news\/eu-us-data-privacy-framework-nuove-garanzie-per-il-trasferimento-dei-dati-personali-negli-usa-2\/"},"modified":"2026-04-07T18:23:22","modified_gmt":"2026-04-07T16:23:22","slug":"eu-us-data-privacy-framework-nuove-garanzie-per-il-trasferimento-dei-dati-personali-negli-usa","status":"publish","type":"post","link":"https:\/\/www.delucapartners.it\/en\/insights\/eu-us-data-privacy-framework-for-the-transfer-of-personal-data-to-the-usa\/","title":{"rendered":"EU-US Data Privacy Framework: new safeguards for the transfer of personal data to the USA"},"content":{"rendered":"\n

On 10 July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework ensuring that the United States of America guarantees an adequate level of protection of personal data comparable to that of the European Union.<\/p>\n\n\n\n

The adequacy decision is one of the tools provided for by Regulation (EU) 2016\/679 (the \u2018Regulation<\/em><\/strong>\u2019) to transfer personal data from the European Union to third countries that, upon prior assessment by the European Commission, offer \u2018an adequate level of protection\u2019<\/em>, i.e. a level of protection of personal data equivalent to that guaranteed within the EU.<\/p>\n\n\n\n

The consequence is that personal data can be transferred securely and can be managed in the same way as data transmissions that take place within Europe. <\/a><\/p>\n\n\n\n

What does the new EU-US Data Privacy Framework entail?<\/strong><\/strong><\/p>\n\n\n\n

The EU-US Data Privacy Framework is structured around a self-certification mechanism whereby US companies undertake to comply with a number of personal data protection obligations, including, but not limited to, compliance with the principles of purpose limitation, data minimisation and retention, as well as specific obligations regarding data security and data sharing with third parties.<\/p>\n\n\n\n

The organisations\u2019 undertakings will be renewed on an annual basis and are subject to checks and monitoring by the U.S. Department of Commerce, which will process certification applications and periodically verify compliance with the requirements by participating companies.<\/p>\n\n\n\n

European citizens will benefit from several independent and impartial remedies in the event that their data is processed in a non-compliant manner, including the newly established Data Protection Review Court (DPRC).<\/p>\n\n\n\n

US law will provide a number of safeguards, including limiting access to personal data by public authorities to what is necessary and proportionate to protect national security or to enforce criminal law.<\/p>\n\n\n\n

In any case, the Data Privacy Framework will be subject to periodic revisions by the European Commission together with representatives of the European data protection authorities and the competent US authorities.  The first review will take place within one year of the entry into force of the adequacy decision.<\/p>\n\n\n\n

The other instruments provided for by the Regulation<\/strong><\/strong><\/p>\n\n\n\n

It is worth remembering that in addition to the adequacy decision, the Regulation also provides for other tools to ensure the correct transfer of data outside the European Union, including:<\/p>\n\n\n\n