The European Commission finally adopted its adequacy decision for the EU-U.S. Data Privacy Framework on July 10th, 2023.

This decision concludes that the United States ensures an adequate level of protection for personal data transferred from the EU to US companies under the new framework. On this basis, personal data can flow safely from the EU to US companies participating in the Framework, without having to put in place additional data protection safeguards.

“The EU-U.S. Data Privacy Framework introduces new binding safeguards to address all the concerns raised by the European Court of Justice, including limiting access to EU data by US intelligence services to what is necessary and proportionate, and establishing a Data Protection Review Court (DPRC), to which EU individuals will have access.” Source.

What we consider as main ideas in the adequacy decision:

The companies in US could join the EU-U.S. Data Privacy Framework by complying with a list of privacy obligations, for example the requirement to delete personal data when it is no longer necessary for the purpose for which it was collected, and to ensure continuity of protection when personal data is shared with third parties.

EU individuals will benefit from several redress avenues in case their data is wrongly handled by US companies. This includes free of charge independent dispute resolution mechanisms and an arbitration panel.

Also, the US legal framework provides for several safeguards regarding the access to data transferred under the framework by US public authorities, for criminal law enforcement and national security purposes. Access to data is limited to what is necessary and proportionate to protect national security.

Useful:

Adequacy decision is available here.

Details on how personal data transfers between Eu and US is protected can be found here.

For a specialized analysis we recommend this article.

Post main source is EU Commission webpage

Picture credits: pexels.com