Data transfers: Adequacy decision opens up EU-US personal data flows once more

Why should I read this?

On July 10, 2023, the European Commission formally adopted an adequacy decision in respect of the EU-US Data Privacy Framework (DPF). The decision, which took immediate effect, enables organizations to transfer personal data freely from the EU to US companies participating in the DPF.

As a reminder, an “adequacy decision” is one way in which organizations subject to the General Data Protection Regulation 2016/679 (EU GDPR) can transfer personal data out of the EU to a third country. The European Commission can make a positive finding of adequacy where it is satisfied that the third country provides a data protection system that is essentially equivalent to that of the EU.

The DPF adequacy decision is the culmination of months of discussions between the European Union and United States in an effort to facilitate EU-US data transfers, following the Court of Justice of the European Union’s (CJEU) decision in Schrems II which invalidated the EU-US Privacy Shield.

In its press release and as confirmed in an accompanying Q&A, the Commission emphasized the various steps taken by the US to revise its practices in response to the issues identified by the CJEU’s ruling (specifically, the limitations and safeguards introduced by the Executive Order 14086 on ‘Enhancing Safeguards for United States Signals Intelligence Activities') and the following features of the DPF:

• certified organizations must commit to a detailed set of privacy obligations, including in respect of data retention, providing individuals whose data is transferred from the EU to certified organizations with privacy rights to obtain redress from them, including free of charge independent dispute resolution
• limiting access to EU data by US intelligence services to what is necessary and proportionate
• enhanced oversight of activities by US intelligence services to ensure compliance with limitations on surveillance activities
• establishing independent and free of charge redress avenues in case individuals’ data is wrongly handled by US national security authorities, including the new Data Protection Review Court, to resolve complaints regarding such access to data

The DPF will be administered by the US Department of Commerce (DoC), which will process applications for certification and monitor whether participating companies continue to meet their certification criteria. The US Federal Trade Commission will enforce compliance with the DPF. Eligible US organizations will be able to sign up to the DPF on a self-certification basis through the DoC, by committing to comply with a set of privacy obligations.

The European Commission will keep the DPF under review – the first review will take place within one year, and subsequent reviews at regular (at least every four years) intervals thereafter.

These EU developments also benefit data transfers to the US from Norway, Liechtenstein and Iceland, the other countries in the European Economic Area.

What should I do?

Companies subject to EU GDPR sending personal data to the US:

• The DPF is available to be used as an adequacy mechanism to protect your transfers. You should consider whether the DPF is an appropriate safeguard for your arrangement. If you decide that it is, you should check that the US recipient of the personal data has a valid and up to date certification covering the relevant data transfers. You will also need to update your EU GDPR compliance documentation, including your record of processing activities and privacy notices. In addition, ensure that the contract you have in place with the US recipient backs up their commitments under the DPF, such as the notice and accountability for onward transfers principles. We would also recommend considering whether to adopt an alternative safeguard (e.g. the EU Standard Contractual Clauses (SCCs)) as an extra layer of protection, in case the DPF is invalidated (see our further commentary on this point below)
• The Commission has confirmed in its press release that the new US privacy safeguards relating to national security “will also facilitate transatlantic data flows more generally, since they also apply when data is transferred by other tools, such as standard contractual clauses.” With this in mind, companies should review their transfer impact assessments underpinning all EU-US personal data transfers (not just those made on the basis of the DPF) and update them as needed. The Commission’s statement suggests that the adaptations made by the US may negate the need for supplementary measures to be taken when relying on other safeguards, including SCCs for data transfers to the US – read our briefing for a reminder on those. As noted above, despite this development, we recommend considering putting back up measures in place in case the CJEU rules in future that the new US safeguards are still insufficient.

US companies receiving personal data from the EU:

• If you are a US organization receiving personal data from the EU and would like to participate in the framework, you can self-certify through a new website www.dataprivacyframework.gov which, according to this statement from the US DoC on the Privacy Shield website, will be launched on July 17, 2023.
• Organizations certified under the previous EU-US Privacy Shield will be provided with guidance to facilitate their transition to the DPF. These organizations must comply with the DPF Principles, including by updating their privacy policies by October 10, 2023. They do not need to make a separate, initial self-certification submission to participate in the DPF and may begin relying on the DPF adequacy decision immediately. Organizations that self-certified under the EU-US Privacy Shield but do not wish to participate in the DPF must complete the prescribed withdrawal process. Individuals with active Privacy Shield accounts will be able to use their existing login credentials for the DPF. From July 17, 2023, e-mails to the International Trade Administration DPF team should be sent to dpf.program@trade.gov (the privacyshield@trade.gov e-mail address will no longer be used).

What else do I need to know about the DPF?

The DPF is not the first of its kind. Its predecessors, the Safe Harbour Privacy Principles and the EU-US Privacy Shield were invalidated by the CJEU in 2015 and 2020 respectively, following legal challenges. Privacy activists have already confirmed their plans to challenge the new Data Privacy Framework – citing, in the main, the DPF’s failure to sufficiently address the wide surveillance powers of US intelligence agencies – and have speculated that a challenge could reach the CJEU by the end of 2023 or start of 2024.

Previous similar efforts to facilitate EU-US data transfers have proved short-lived, but the DPF adequacy decision is (for now) binding and therefore provides a legitimate and EU GDPR-compliant mechanism for those who choose to rely on it.

And what about UK-US transfers? While this decision does not impact transfers of personal data from the UK to the US, the approval of the EU-US Data Privacy Framework should speed up the timeframe for the UK-US data bridge – the UK’s Data Privacy Framework that the US and UK committed to reach an agreement on last month. The DoC has confirmed that from July 17, 2023, eligible US organizations wishing to self-certify compliance pursuant to the UK extension to the EU-US DPF may do so but they may not begin relying on the UK extension to receive personal data transfers from the UK before the date that the UK’s relevant adequacy regulations enter into force.

Further reading on the EU-US Data Privacy Framework:

Press release

Adequacy decision on the EU-US Data Privacy Framework

Questions & Answers: EU-US Data Privacy Framework

Factsheet

Statement from US Secretary of Commerce Gina Raimondo on the European Union-US Data Privacy Framework

DoC operational updates statement

__________

Authors:
Michael Bahar | +1 202 383 0882 | Email
Paula Barrett | +44 207 919 4634 | Email
Olaf Van Haperen | +31 617 456 299 | Email
Nils Müller | +49 89 54565 194 | Email
Marie McGinley | +353 1 6441 457 | Email
Liz Fitzsimons | +44 122 344 3808 | Email
Emmanuel Ronco | +33 1 55 73 40 00 | Email