On 10 July 2023, the European Commission took a significant step by issuing its adequacy decision on the EU-US Data Privacy Framework (DPF). This decision has been eagerly awaited following the invalidation of the previous adequacy decision by the Court of Justice of the European Union (CJEU) in the case of C-311/18 (commonly referred to as ‘Schrems II’).
Accordingly, data transfers to US businesses certified under the DPF should be exempt from the requirements of Article 46 of the GDPR. As a reminder, Article 46 requires organisations to implement additional safeguards, such as the standard contractual clauses, and to evaluate the effectiveness of these safeguards in the absence of an adequacy decision.
The latest adequacy decision has been met with enthusiasm by many, given the economic opportunities it presents. However, it also presents a challenging compliance exercise for US businesses that were previously certified under the EU-US Privacy Shield framework. These US businesses must update their privacy policies and principles to reflect the requirements of the DPF by October 10, 2023.
The EU-US adequacy decision is a pivotal development with far-reaching implications for businesses engaged in transatlantic data transfers.
Some EU businesses might, accordingly, wish to consider the following:
How can we help?
At PwC Malta, our Privacy and Data team has extensive expertise and resources to guide your organisation on international data transfer rules. For more information regarding our services relating to GDPR compliance, reach out to us or visit our General Data Protection Regulation page.
