🔒 Practical implications following the EU Commission's adequacy decision for the EU-U.S. Data Privacy Framework 🔒
📅 On 10 July 2023, the European Commission adopted its adequacy decision on the EU-U.S. DPF, but what does this mean operationally for transfers from the EU to organizations in the U.S.?
✉️ Transfers of personal data can now be made to U.S. organizations certified as EU-U.S. DPF participants without needing appropriate safeguards like Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs).
📜 The DoC confirmed that active Privacy Shield participants may immediately rely on the EU-U.S. DPF. Such organizations are required to update their privacy notices to reflect reliance on the EU-U.S. DPF and its principles by 10 October 2023. Organizations that do not wish to comply with the EU-U.S. DPF principles must complete a withdrawal process.
🛡️ Transfers to U.S.-based organizations that are not EU-U.S. DPF participants cannot be based on the adequacy decision. Such transfers will still require appropriate safeguards such as SCCs (including transfer impact assessments) or BCRs.
🇬🇧🇨🇭 The EU adequacy decision does not benefit the UK or Switzerland. The UK recently reiterated its commitment to a UK-U.S. Data Bridge, but until it reaches an adequacy decision, transfers from the UK/Gibraltar to the U.S. still need an IDTA or UK Addendum to the SCCs. The same applies to Switzerland. Adequacy decisions from both are expected soon.
🏛️ The EU-U.S. DPF marks a significant step forward, but for how long before a further legal challenge is mounted?