A Relief For Companies: The New "EU US Data Privacy Framework" Is In Force!

The CJEU's annulment of the "Privacy Shield" created significant legal uncertainty around the use of US clouds and personal data transfers to the US. Fortunately, summer 2023 brings good news: this legal uncertainty has gone. On 10 July 2023, the European Commission has adopted an adequacy decision on the "EU US Data Privacy Framework" (DPF).

The DPF allows transfers of personal data to the US under essentially the same mechanisms as under its predecessor, the "Privacy Shield". Thus, if a US company gets certified under the "EU US Data Privacy Framework", it creates a data protection level that is adequate to the European data protection laws. It follows that personal data can be transferred from Europe to that company without a need for additional safeguards under Art 46 GDPR. A search registry of the US companies certified under the DPF can be found under: https://www.dataprivacyframework.gov/s/participant-search.