What is the EU – U.S. Data Privacy Framework?

In news that’s excited the privacy industry worldwide—the EU – U.S. Data Privacy Framework (DPF) was announced on Monday, July 10, 2023, and took near immediate effect. This comes after months of review and public comment, but now, with the DPF functioning as a new adequacy mechanism under General Data Protection Regulation (GDPR), organizations can once again transfer data under an adequacy decision if they adhere to and self-certify against the DPF.

Given that it’s been almost three years since the U.S. had an adequacy decision, those in privacy—particularly in the United States and European Union—are more likely to understand how significant of a development this is, but for those that don’t know, we’re going to explain.

Our devoted Privacy Practice has been watching the DPF’s progress, and in this article, we’ll briefly go over how the framework got to this point, what you can find on the new live website, and quick notes on how you can ensure your Privacy Shield self-certification transfers over.

After reading, you’ll be better positioned to steer your organization forward under this new mechanism.

How Did the EU – U.S. Data Privacy Framework Develop?

Though first introduced in March 2022, the DPF was later strengthened via executive order by President Biden in October 2022 before the European Union began its process two months after that:

• March 2022 (Initial Announcement): President von der Leyen of the European Commission and American President Biden announced their agreement in principle on a new EU-U.S. Data Privacy Framework to more easily foster trans-Atlantic data flows and address privacy concerns raised by the Court of Justice of the EU back in 2020—this would be done through the establishment of important legal mechanisms facilitating the communication of personal data between the EU and United States.
• October 2022 (Biden Executive Order): Signed six months after the initial announcement, this EO instructed the U.S. to begin implementation of the related, newly developed mechanisms and safeguards.
• December 2022 (European Commission Decision): A couple of months following Biden’s green light for the U.S., the European Commission adopted its own draft adequacy decision for the DPF, which began the European Union’s formal adoption process.

Over the following six months, the DPF received a good bit of backlash from European privacy authorities and advocates who said that—with its limited updates on the government surveillance issue—the DPF was merely a repackaging of the previously struck down Privacy Shield. (Government surveillance concerns had been one of the main factors in the Schrems II case that saw the Court of Justice dismantle Privacy Shield.)

Despite that, the European Data Protection Board’s (EDPB) opinion on the framework showed more positive promise, and earlier this year, hopes were high that the mechanism would be approved. On July 10, 2023, those hopes were realized when the European Commission adopted an adequacy decision for the DPF, one week after U.S. Secretary of Commerce Gina Raimondo issued a statement decreeing the full implementation of the EU-US Data Privacy Framework and the European Commission Comitology Committee signed off on the revised draft adequacy decision.

Now that it has been fully approved and has gone into effect, the Data Privacy Framework replaces its predecessors as the new adequacy mechanism for the United States. Given that those predecessors—the EU-U.S. Safe Harbor and EU-U.S Privacy Shield—had already been previously invalidated by Schrems I and Schrems II, everyone in the privacy industry is hoping this new framework and associated adequacy decision sticks around for longer (though rumor has it that Schrems III is already in development).

But for the time being, U.S. organizations participating in the DPF have the opportunity to transfer data from the EU based on an adequacy decision.

How to Participate in the EU – U.S. Data Privacy Framework

Speaking of which, the U.S. website for participating in the DPF did not go live until this week, on July 17, 2023 (despite the framework officially entering into force on July 11, 2023).

The website details information relating to:

• The program itself;
• Framework requirements;
• Participants; and
• European individuals, businesses, and data protection authorities.

The website is co-managed by the International Trade Administration and the U.S. Department of Commerce, though the Federal Trade Commission still maintains oversight for program enforcement.

At the time of this writing—on July 18, 2023—the new website already has 250+ organizations that have self-certified against the DPF. Most of these are participants that have carried over their certification from the Privacy Shield website—or are at least in the process of doing so, as there are necessary relevant steps that must be completed (as communicated by the Department of Commerce).

How to Transfer Your Privacy Shield to the DPF

These steps for ensuring your current Privacy Shield self-certification transfers over under the DPF include:

• Updating your privacy notice with the new required DPF language by October 10, 2023.
• Required compliance with the DPF Principles.
• Required recertification each year.
  • Your recertification date will be the same as your Privacy Shield recertification date (carried over).
  • Organizations can recertify through the DPF website as soon as it goes live.

Need Help with the DPF?

This new Data Privacy Framework will help ensure durable and secure data flows back and forth between the EU and America, laying the foundation for a competitive digital economy and further economic cooperation between these two major world players.

As the rest of the world adjusts to this critical new development, you may find that you require/desire assistance during the self-certification process. For our part, Schellman will offer services similar to those we offered for the now-defunct Privacy Shield—we can either:

• Assist organizations prepare for self-certification through gap/readiness activities; or
• Perform independent reporting to provide assurance that the self-certification remains valid.

If you’re interested in learning more about those types of potential partnerships with us—or if you have any further questions regarding the framework in general—please feel free to contact us so that our team can address your concerns and ease your transition as much as possible.