- On 10 July the European Commission declared that the United States offers adequate protection for data sent to companies that join the new framework.
- For those certified companies, transfers no longer require standard contractual clauses or other additional mechanisms.
- The practical key is to check which providers are really certified and keep a fallback plan in case the framework is struck down.
On 10 July 2023 the European Commission adopted an adequacy decision on the EU-US Data Privacy Framework. In simple terms, Brussels recognises that US companies that voluntarily join the framework handle Europeans’ personal data with a level of protection comparable to the Union’s. The decision took effect on adoption and, in practice, replaces the old Privacy Shield.
It matters because almost every European business sends data to the United States without noticing: email, cloud storage, payroll or customer-management software, videoconferencing tools. For three years those transfers relied on contractual clauses and complex assessments. There is now a simpler route, although neither universal nor definitive.
Why it was needed
The Privacy Shield, which covered these transfers, was struck down by the EU Court of Justice in July 2020 (the “Schrems II” ruling). The Court held that surveillance by US intelligence services was not sufficiently limited and that European citizens lacked an effective remedy. Since then, businesses have had to rely on standard contractual clauses and a case-by-case assessment of the risk of each transfer.
The new framework responds to those criticisms. In October 2022 the United States issued an executive order limiting its intelligence agencies’ access to what is strictly necessary and proportionate, and created a Data Protection Review Court to which Europeans can turn. The Commission relies on those safeguards to conclude that the level of protection is equivalent.
What changes in practice
A European company can send personal data to a US company certified under the framework without needing standard clauses or binding corporate rules. Certification is voluntary, is run by the US Department of Commerce and obliges the company to respect a set of privacy principles under the supervision of US authorities. The list of participating companies is public and can be checked.
For uncertified companies, nothing changes: they still need standard contractual clauses or another mechanism provided for by the General Data Protection Regulation. Other obligations do not disappear either, such as informing the people concerned, keeping the record of processing activities or signing a contract with the provider acting as processor. A common case is a small business using email or cloud storage from a US provider: before relying on the decision, it should check that the provider appears on the list of certified companies and that its certification covers the type of data it handles, for example human resources data.
What to review
A reasonable first step is to identify which US providers process personal data and check whether they appear as certified. If they do, the documentation can be updated to rely on the adequacy decision; if not, it is advisable to keep the current standard clauses. It is also a good moment to review privacy policies, which must clearly explain transfers to countries outside the Union.
Prudence is advisable. The framework may be challenged in court, as its predecessors were, and the Commission itself will review the decision periodically, with a first evaluation after one year. Keeping the standard clauses as a backstop, even if unused, avoids being left without cover if the framework is questioned again. For specific cases, consult your adviser.
When data crosses the Atlantic, peace of mind comes from a verified certification and a fallback plan.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
