European Commission Adopted Its Adequacy Decision For The EU-U.S. Data Privacy Framework

On 10 July 2023, European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework (DPF). The decision concludes that the United States ensures an adequate level of protection – comparable to that of the European Union – for personal data transferred from the EU to US companies under the new framework.

US companies will be able to join the EU-U.S. Data Privacy Framework by committing to comply with a detailed set of privacy obligations, for instance the requirement to delete personal data when it is no longer necessary for the purpose for which it was collected, and to ensure continuity of protection when personal data is shared with third parties.

The European Data Protection Board released an informative note about the adequacy decision to the U.S.

Takeaways:

• Personal data can flow safely from the EU to US companies , without having to put in place additional data protection safeguards
• Transfers to entities in the US which are cannot be based on the Adequacy Decision and . When conducting the assessment exporters can consider the assessment made by the European Commission in the Adequacy Decision
• Individuals are encouraged to first raise . If necessary, seek advice from the EU Data protection authorities
• Data subjects in the EU to make use of the new redress mechanism in the area of national security

If you need a consultation regarding the application of the EU-U.S. Data Privacy Framework, do not hesitate to contact us.

Prepared by Associate Partner, Certified Data Protection Expert (CIPP/E) Brigida Bacienė