DPO Hub
transfers resource

Your OSS for the EU-US DPF

The European Commission has now adopted its adequacy decision for the EU-US Data Privacy Framework, concluding that the United States ensures an adequate level of protection – comparable to that of the European Union – for personal data transferred from the EU to US

Jul 10, 2023 — 4 min read
Your OSS for the EU-US DPF

Newest resources

10 July 2023: DPF approved!

The European Commission has now adopted its adequacy decision for the EU-US Data Privacy Framework, concluding that the United States ensures an adequate level of protection – comparable to that of the European Union – for personal data transferred from the EU to US companies under the new framework. On the basis of the new adequacy decision, personal data can flow safely from the EU to US companies participating in the Framework, without having to put in place additional data protection safeguards.

Note that the adequacy is for certified US companies and not the entire country.

❌ Max Schrems have already stated that they (noyb) will challenge the new framework, so keep in mind that the DPF might not survive that CJEU round either. (And, the US is just one territory - we still have to do TIAs and supplementary measures for other third countries...)

Like before, US companies can certify for the DPF by committing to comply with a detailed set of privacy obligations published on the certification website. Note that the DPF currently only applies to US companies.

Those already certified under the Privacy Shield will receive information from their certification partners about next steps, but in short you're expected to update your privacy policy (within three months) and otherwise be able to comply with the DPF principles (which are, by large, the same as before).

🎥 Also check out the LinkedIn event with Caitlin Fennessy (IAPP) and Alex Greenstein (Director DPF, U.S. Department of Commerce): The DPF in practice where they also addressed some key questions.

  • To certify visit the certification website.
  • 17 July Press release U.S. Departments of Commerce and Justice and the European Commission Reaffirm Shared Values, Welcome Finalized EU-U.S. Data Privacy Framework.
  • 10 July Statement from President Joe Biden on EU Adoption of Adequacy Decision for U.S.-EU Data Flows.
  • 10 July Statement from U.S. Secretary of Commerce Gina Raimondo on the European Union-U.S. Data Privacy Framework.

💜 From noyb & Max Schrems

  • 14 August noyb: 23 years of illegal data transfers due to inactive DPAs and new EU-US deals.
  • 10 July noyb's reaction to the DPF announcement: New Trans-Atlantic Data Privacy Framework largely a copy of "Privacy Shield". noyb will challenge the decision.

Various, including DPA press releases and guidance:

  • 🇪🇺 12 Oct The General Court rules against interim measures to pause the implementation of the DPF (Latombe's challenge).
  • 7 Sep Politico reports that MP Philippe Latombe challenges the DPF.
  • 18 July iapp article A guide to the attorney general’s finding of 'reciprocal' privacy protections in EU ("qualifying states").
  • 🇪🇺 The EDPB has so far only tweeted that "In the next few weeks the EDPB will develop an information note for stakeholders on the implications of the DPF".
  • 🇳🇴 Datatilsynets spørsmål og svar.
  • 🇩🇰 Datatilsynets spørgsmål og svar.
  • 🇸🇪 Integritetsskyddsmyndigheten (IMY) has just posted a simple note.

Got other relevant links? Please share with me on LinkedIn!

  • 🇺🇸 3 July Statement from U.S. Secretary of Commerce Gina Raimondo on the European Union-U.S. Data Privacy Framework.
  • 🇺🇸 20 June U.S. Department of Justice Memorandum in Support of Designation of the European Union and Iceland, Liechtenstein and Norway as Qualifying States Under Executive Order 14086 (PDF direct link).
  • 🇪🇺 25 March Factsheet – Transatlantic Data Privacy Framework.
  • 🇺🇸 25 March Fact sheet from the White House: United States and European Commission Announce Trans-Atlantic Data Privacy Framework.
  • 💜 13 December noyb's reaction to the Draft adequacy decision: Statement on US Adequacy Decision by the European Commission.
  • 🇪🇺 13 December Press release: Commission starts process to adopt adequacy decision for safe data flows with the US.
  • 🇪🇺 13 December The actual Draft adequacy decision.
  • 🇪🇺 13 December Q&A on the Draft adequacy decision.
  • 🇪🇺 7 October Q&A (web, also see handy PDF at the end of the page).
  • 🇺🇸 7 October Statement on the Executive Order from the U.S. Secretary of Commerce.
  • 🇺🇸 7 October Fact sheet from the White House: President Biden Signs Executive Order to Implement the European Union-U.S. Data Privacy Framework.
  • 💜 7 October noyb's first reaction and summary: Executive Order on US Surveillance unlikely to satisfy EU law.
  • 💜 7 October Direct download (PDF) to noyb's structured (very helpful!) version of the Executive Order with bookmarks down to layer 3.
Published by
Rie Aleksandra
Rie Aleksandra
https://www.linkedin.com/in/riealeksandra/
You might also like
Great! Next, complete checkout for full access to DPO Hub.
Welcome back! You've successfully signed in.
You've successfully subscribed to DPO Hub.
Success! Your account is fully activated, you now have access to all content.
Success! Your billing info has been updated.
Your billing was not updated.