The European Commission has announced today 10 July 2023 the adoption of its "adequacy decision" on the EU - US Data Privacy Framework (“DPF") to allow EU-US data flows to businesses that will have adhered to the EU-US DPF.
The US is said to have recently fulfilled its DPF requirements as well. Similar to what was the case for privacy shield, the U.S. Department of Commerce’s International Trade Administration (ITA) has already published its website (https://www.dataprivacyframework.gov) for self-certification and a public list.
The European Commission had published on 13 December 2022 its preliminary “adequacy decision” for the DPF as the next step following the Executive Order proposed by US President Joe Biden on 7 October 2022 to implement the EU-US DPF and replace the invalidated Privacy Shield (“Executive Order”).
The Executive Order seeks to limit the ability of US agencies to access large amounts of personal data transferred from the European Union. The Executive Order also establishes a new legal redress mechanism for EU citizens to challenge US intelligence agencies’ surveillance activities as violations of the Executive Order. Read more here about this redress mechanism.
The changes aim to address the criticism of the Court of Justice of the European Union (“CJEU”) in its Schrems II ruling of 16 July 2020 (C-311/18), which declared the previous data transfer pact known as the Privacy Shield Framework invalid because mass surveillance by US intelligence agencies did not meet the minimum standards of the rule of law.
It is expected that Max Schrems, the Austrian privacy activist known for his successful challenges of the two previous EU-US data agreements, will challenge the DPF before court. Indeed, he has already stated his intention to challenge the framework and push for a Schrems III decision, claiming that the Executive Order fails to adequately limit US surveillance and provide effective legal redress.
The functioning of the EU-U.S. Data Privacy Framework will be subject to periodic reviews, to be carried out by the European Commission, together with representatives of European data protection authorities and competent US authorities. The first review will take place within a year of the entry into force of the adequacy decision, in order to verify that all relevant elements have been fully implemented in the US legal framework and are functioning effectively in practice.
- Link to Press Release: https://ec.europa.eu/commission/presscorner/detail/en/ip_23_3721
