EU-U.S. Data Privacy Framework Restores Legal Certainty for EU-U.S. Data Transfers
Written by Achieved Compliance
Years of intense negotiation between the EU and the U.S. took place. Finally, in July, the European Commission took the final steps to formally adopt the new EU-U.S. Data Privacy Framework. Restoration of the Framework reduces the uncertainty about lawful data transfer that came with the invalidation of the U.S-EU Privacy Shield by the Court of Justice of the European Union (CJEU) in the Schrems II case.
According to the European Commission’s press release, the Commission determined that the United States protects personal data transferred from the EU to the U.S. under the Framework. As a result, the Framework provides EU companies transferring personal data to the U.S. with an additional mechanism to legitimize their transatlantic data transfers.
The Framework makes it possible for U.S. companies to self-certify that they meet the Framework’s requirements and commit to its privacy obligations. By doing so, companies can receive EU personal data without implementing additional transfer safeguards.
The Framework empowers European citizens to access better redress mechanisms when organizations handle their personal data in ways that breach the principles of the EU-U.S. Data Privacy Framework.
Companies currently self-certified under the EU-U.S. Privacy Shield Framework will have access to a simplified procedure for self-certification under the EU-U.S. Data Privacy Framework.
Concerns persist that the Framework may face legal challenges, as did its predecessor, the EU-U.S. Privacy Shield, about possible legal challenges to the Framework. However, EU Justice Commissioner Reynders commented that the Commission is committed to defending it in any judicial proceedings.
The EU-U.S. Data Privacy Framework will be subject to periodic reviews by the European Commission and representatives of European data protection authorities and competent U.S. authorities.
Read the Adequacy Decision, the Factsheet, and the Questions and Answers.
Are you looking for help with compliance? Schedule your free consultation with us.
PRIVACY BLOG
New Fine Highlights the Necessity of EU-GDPR Article 27 Representation for US Companies
The Data Use and Access Act 2025 (DUAA) Key Changes to Data Protection Law
Privacy Compliance: Why Software Solutions Could Put You at Risk
The Troubling Cuts to Medical Research
ARE YOU CREATING PRIVACY ISSUES WITH AI?
European Commission Publishes New Standard Contractual Clauses and Guidance on Implementation
New York State Attorney General’s Office Issues Guidance on Tracking Technologies and Privacy
Connecticut Attorney General’s Office Releases Report on New Data Privacy Law
Data Protection Commissioner of Ireland (DPC) Investigation Focuses on Location Data The DPC recently wrote to inform data controllers who may be in receipt of or sharing location data that it has initiated the regulatory assessment. It also notified organizations linked to those whose activities are the subject of the DPC assessment and stressed that failure to meet statutory obligations pertaining to processing of location data will result in regulatory action.