The revised EU-US Data Privacy Framework (‘DPF’) was adopted by the European Commission and came into force on Monday 10 July 2023. This ‘adequacy decision’ reflects the European Commission’s view that the protections in place for personal data transferred from the European Union (EU) to United States (US) companies which participate in the DPF are ‘adequate’ for the purposes of the EU GDPR.

The DPF restores a means of transferring personal data from the EU to the US, following the earlier invalidation by the Court of Justice of the European Union (‘CJEU’) of two predecessor frameworks (the ‘Safe Harbor’ and the ‘Privacy Shield’) in the Schrems I and Schrems II decisions. You can read our summary about previous EU-US Data Privacy frameworks and the Schrems decisions here.

What is an adequacy decision and why does it matter?

The concept of an ‘adequacy decision’ is found in article 45 of the General Data Protection Regulation (‘GDPR’). Article 45 provides that the transfer of personal data from an EU country to a third country outside the EU is permitted where the European Commission has determined that the third country (or a specified sector within that third country) maintains an ‘adequate level of protection’. Receiving adequacy status significantly reduces compliance for organisations because it means that the transfer of the personal data to a third country outside the EU that benefits from that status does not require any additional authorisation.

The European Commission determined in late 2012 that the legal framework in New Zealand constitutes an ‘adequate level of protection’, a status that New Zealand has retained ever since—albeit subject to ongoing scrutiny from the European Commission, as the minimum legal protections in both the EU and New Zealand have evolved over time. This decision of adequacy has significantly reduced the compliance burden on New Zealand organisations processing personal data on behalf of EU-based customers, including New Zealand SaaS companies and other entities doing business in or with the EU.

Attempt #3—what does this ‘new and improved’ framework look like?

An important addition of the new framework is that to benefit from the DPF, US organisations must self-certify their commitment to the DPF Principles and Supplemental Principles as issued by the US Department of Commerce. To be eligible for this, an organisation must be subject to the investigatory and enforcement powers of the Federal Trade Commission or the US Department of Transportation. Organisations that were registered under the former EU-US Privacy Shield are likely to be transferred automatically—provided they update their privacy policies and other documents within the next three months. Once a US organisation has been certified, it must be re-certified on a yearly basis.

The DPF also imposes further limitations on US intelligence agencies accessing the personal data of Europeans. The previous Presidential Policy Directive (PPD-28) has been replaced by an Executive Order titled ‘Enhancing Safeguards for United States Signals Intelligence Activities’ (EO 14086) which is purportedly more difficult to repeal.

In particular, the Executive Order:

• limits access of US intelligence agencies to what is ‘necessary’ and ‘proportionate’ to protect national security;
• increases oversight for the activities of US intelligence agencies to ensure compliance; and
• establishes independent and impartial redress mechanisms, including the new Data Protective Review Court tasked with investigating and resolving complaints by Europeans who have had their personal data accessed by US national securities.

Is third time really the charm?

Despite the DPF’s new safeguards, it is still being criticised as an inadequate data protection framework.

A key criticism of the DPF is that US intelligence agencies can still access the personal data of Europeans, so long as they consider whether that surveillance is ‘necessary’ and ‘proportionate’ to the national security objective for which it was initially authorised. What is ‘proportionate’ is particularly contentious in the context of ‘bulk surveillance’ carried out by US intelligence agencies—with the view of whether surveillance of that nature is ‘proportionate’ is not necessarily common ground between the US, the European Commission and the CJEU.

Another point of criticism is that the DPF is quite limited in its scope. The DPF only applies to certified US organisations, which is quite narrow compared to other data transfer arrangements between the EU and third countries.

Schrems III on the horizon?

Max Schrems has expressed his disapproval of the DPF. He argues the DPF merely copies previous EU-US arrangements and does not present any substantive changes to US surveillance law (and in particular, the rights of non-US citizens under that law). Although he has stated he is ‘tired of this legal ping-pong’, he believes the role of the European Commission is to be ‘guardian of the treaties’ and ‘defender of the rule of law’. He expects this issue will be returned to the CJEU by early 2024.

Get in touch

If you'd like to know more about how this new framework might affect you—especially if you operate in the EU or provide services to EU-based customers—then get in touch with our privacy and data protection experts Hayley Miller, Campbell Featherstone or Gunes Haksever. See also this publication by our Dentons Global colleagues.

This article was written by Lavi Abitbol, a law graduate in our commercial, technology and privacy team.