On 10 July 2023, the European Commission adopted the long-awaited adequacy decision for the EU-US Data Privacy Framework (the DPF), concluding a three-year legal limbo for EU-US data transfers following the invalidation of the previous adequacy decision on the EU-US Privacy Shield by the Court of Justice of the European Union (the CJEU).

Background

On 3 July 2023, the United States Secretary of Commerce Gina Raimondo announced that the United States fulfilled its commitments for implementing the DPF, which had been ‘in principle’ agreed by President Joe Biden and the European Commission President Ursula von der Leyen in March 2022, following extensive negotiations to address the concerns raised by the CJEU in the Schrems II  decision of July 2020.

The new framework

On the basis of the DPF, personal data can now flow safely from EU to US companies participating in the DPF, without having to put in place additional data protection safeguards.

The DPF introduces the following new binding safeguards:

• Limiting access to EU personal data by US intelligence agencies to what is necessary and proportionate; and
• EU individuals will have access to an independent and impartial redress mechanism regarding the collection and use of their data by US intelligence agencies, which includes a newly established Data Protection Review Court which will be handling and resolving complaints.

Importantly, the European Commission has clarified in its Q&As that the above safeguards will apply to all data transfers under the GDPR to companies in the US, regardless of the transfer mechanisms used. These safeguards are therefore also intended to facilitate the use of other tools, such as standard contractual clauses and binding corporate rules.

The DPF likely comes with a great sigh of relief for many businesses relying on cross-border data flows on both sides of the Atlantic, as it provides a stable legal framework and regulatory certainty after a long period of uncertainty following Schrems II which invalidated the previous EU-US adequacy decision.

The European Commission’s press release on the Adequacy Decision can be found here.

The Adequacy Decision can be found here.

The European Commission’s Q&As on the Adequacy Decision can be found here.

The statement from the US Secretary of Commerce can be found here.