ec.europa.eu Open in urlscan Pro
2a01:7080:14:100::666:30  Public Scan

Form analysis
1 forms found in the DOM

GET https://ec.europa.eu/search/index.do?

<form _ngcontent-c2="" accept-charset="UTF-8" action="https://ec.europa.eu/search/index.do?" class="ecl-search-form ecl-site-header__search" id="nexteuropa-europa-search-search-form" method="get" ngnoform=""><label _ngcontent-c2=""
    class="ecl-search-form__textfield-wrapper"><span _ngcontent-c2="" class="ecl-u-sr-only">Search this website</span><input _ngcontent-c2="" class="ecl-text-input ecl-search-form__textfield" id="edit-querytext" maxlength="128" name="QueryText"
      title="Search" type="search" value=""></label><button _ngcontent-c2="" class="ecl-button ecl-button--form ecl-search-form__button" id="edit-europa-search-submit" name="op" type="submit" value="Search">Search</button><input _ngcontent-c2=""
    name="swlang" type="hidden" value="en"></form>

Text Content

An official website of the European UnionAn official EU websiteHow do you know?

All official European Union website addresses are in the europa.eu domain.

See all EU institutions and bodies

This site uses cookies to offer you a better browsing experience. Find out more
on how we use cookies.

Accept all cookies Accept only essential cookies
Skip to main content
Home - European Commission
Englishen
Search this websiteSearch
You are here:
 1. Home
    
 2. Press corner
 3. Adequacy decision for safe EU-US data flows


Available languages:
българскиčeštinadanskDeutscheestiελληνικάEnglishespañolfrançaisGaeilgehrvatskiitalianolatviešulietuviųmagyarMaltiNederlandspolskiportuguêsromânăslovenčinaslovenščinasuomisvenska
Press release10 July 2023Brussels


DATA PROTECTION: EUROPEAN COMMISSION ADOPTS NEW ADEQUACY DECISION FOR SAFE AND
TRUSTED EU-US DATA FLOWS

Page contents
Top
 * Top
   
 * Quote(s)
   
   
 * Related media
   
 * Print friendly pdf
   
   
   
 * Contacts for media

Today, the European Commission adopted its adequacy decision for the EU-U.S.
Data Privacy Framework. The decision concludes that the United States ensures an
adequate level of protection – comparable to that of the European Union – for
personal data transferred from the EU to US companies under the new framework.
On the basis of the new adequacy decision, personal data can flow safely from
the EU to US companies participating in the Framework, without having to put in
place additional data protection safeguards.

The EU-U.S. Data Privacy Framework introduces new binding safeguards to address
all the concerns raised by the European Court of Justice, including limiting
access to EU data by US intelligence services to what is necessary and
proportionate, and establishing a Data Protection Review Court (DPRC), to which
EU individuals will have access. The new framework introduces significant
improvements compared to the mechanism that existed under the Privacy Shield.
For example, if the DPRC finds that data was collected in violation of the new
safeguards, it will be able to order the deletion of the data. The new
safeguards in the area of government access to data will complement the
obligations that US companies importing data from EU will have to subscribe to.

President Ursula von der Leyen said: “The new EU-U.S. Data Privacy Framework
will ensure safe data flows for Europeans and bring legal certainty to companies
on both sides of the Atlantic. Following the agreement in principle I reached
with President Biden last year, the US has implemented unprecedented commitments
to establish the new framework. Today we take an important step to provide trust
to citizens that their data is safe, to deepen our economic ties between the EU
and the US, and at the same time to reaffirm our shared values. It shows that by
working together, we can address the most complex issues.”

US companies will be able to join the EU-U.S. Data Privacy Framework by
committing to comply with a detailed set of privacy obligations, for instance
the requirement to delete personal data when it is no longer necessary for the
purpose for which it was collected, and to ensure continuity of protection when
personal data is shared with third parties.

EU individuals will benefit from several redress avenues in case their data is
wrongly handled by US companies. This includes free of charge independent
dispute resolution mechanisms and an arbitration panel.

In addition, the US legal framework provides for a number of safeguards
regarding the access to data transferred under the framework by US public
authorities, in particular for criminal law enforcement and national security
purposes. Access to data  is limited to what is necessary and proportionate to
protect national security.

EU individuals will have access to an independent and impartial redress
mechanism regarding the collection and use of their data by US intelligence
agencies, which includes a newly created Data Protection Review Court (DPRC).
The Court will independently investigate and resolve complaints, including by
adopting binding remedial measures.

The safeguards put in place by the US will also facilitate transatlantic data
flows more generally, since they also apply when data is transferred by using
other tools, such as standard contractual clauses and binding corporate rules.

Next steps

The functioning of the EU-U.S. Data Privacy Framework will be subject to
periodic reviews, to be carried out by the European Commission, together with
representatives of European data protection authorities and competent US
authorities.

The first review will take place within a year of the entry into force of the
adequacy decision, in order to verify that all relevant elements have been fully
implemented in the US legal framework and are functioning effectively in
practice.

Background

Article 45(3) of the General Data Protection Regulation (GDPR) grants the
Commission the power to decide, by means of an implementing act, that a non-EU
country ensures ‘an adequate level of protection' - a level of protection for
personal data that is essentially equivalent to the level of protection within
the EU. The effect of adequacy decisions is that personal data can flow freely
from the EU (and Norway, Liechtenstein and Iceland) to a third country without
further obstacles.

After the invalidation of the previous adequacy decision on the EU-U.S. Privacy
Shield by the Court of Justice of the EU, the European Commission and the US
government entered into discussions on a new framework that addressed the issues
raised by the Court.

In March 2022, President von der Leyen and President Biden announced that they
had reached an agreement in principle on a new transatlantic data flows
framework, following negotiations between Commissioner Reynders and US Secretary
Raimondo. In October 2022, President Biden signed an Executive Order on
‘Enhancing Safeguards for United States Signals Intelligence Activities', which
was complemented by regulations issued by US Attorney General Garland. Together,
these two instruments implemented the US commitments reached under the agreement
in principle into US law, and complemented the obligations for US companies
under the EU-U.S. Data Privacy Framework.

An essential element of the US legal framework enshrining these safeguards is
the US Executive Order on ‘Enhancing Safeguards for United States Signals
Intelligence Activities', which addresses the concerns raised by the Court of
Justice of the European Union in its Schrems II decision of July 2020.

The Framework is administered and monitored by the US Department of Commerce.
The US Federal Trade Commission will enforce US companies' compliance.

For More Information

Adequacy decision on the EU-US Data Privacy Framework

Questions and Answers : EU – US Data Privacy Framework

Factsheet – Transatlantic Data Privacy Framework

EU-US data transfers (europa.eu)

International dimension of data protection (europa.eu)

Adequacy decisions (europa.eu)

Joint Statement on Trans-Atlantic Data Privacy Framework (europa.eu)

 


QUOTE(S)

> An adequate protection of our personal data is a fundamental right, and one
> whose importance only continues to grow in our day-to-day lives. Today’s
> decision is the result of intense cooperation with our partners in the US,
> working together to ensure that Europeans’ data travels safely, wherever it
> goes. The new adequacy decision will provide legal certainty for businesses
> and will help further consolidate the EU as a powerful player in transatlantic
> markets, while remaining uncompromising on respecting fundamental right of
> Europeans for their data to be always protected.
> 
> Věra Jourová, Vice-President for Values and Transparency - 09/07/2023


> The adoption of this adequacy decision is the final step to ensure safe and
> free transfers of data across the Atlantic. It ensures the protection of
> individual rights in our intangible and interconnected digital world, where
> physical borders do not matter much anymore. Since the Schrems II decision
> came out years ago, I have worked tirelessly with my US counterparts to
> address the concerns identified by the Court of Justice, and ensure that
> technological advances do not come at the cost of Europeans’ trust. But as
> close like-minded-partners, the EU and the US could find solutions, based on
> their shared values, that are both lawful and workable in their respective
> systems.
> 
> Didier Reynders, Commissioner for Justice - 09/07/2023



RELATED MEDIA

 * DPF Presser
   © Copyright iStock / Getty Images Plus - Tero Vesalainen


PRINT FRIENDLY PDF

Adequacy decision for safe EU-US data flows
English (51.01 kB - PDF)
Download (51.01 kB - PDF)


CONTACTS FOR MEDIA

   

 * CHRISTIAN WIGAND
   
   Phone
   +32 2 296 22 53
   Mail
   christian.wigand@ec.europa.eu

 * CRISTINA TORRES CASTILLO
   
   Phone
   +32 2 29 90679
   Mail
   Cristina.TORRES-CASTILLO@ec.europa.eu

If you do not work for a media organisation, you are welcome to contact the EU
through Europe Direct in writing or by calling 00 800 6 7 8 9 10 11.
IP/23/3721
Share this page:
 * Twitter
 * Facebook
 * LinkedIn
 * E-mail

EUROPEAN COMMISSION

 * European Commission website

FOLLOW THE EUROPEAN COMMISSION

 * Facebook
 * Twitter
 * Other social media

EUROPEAN UNION

 * EU institutions
 * European Union

 * About the Commission's new web presence
 * Language policy
 * Resources for partners
 * Cookies
 * Privacy policy
 * Legal notice
 * Contact

Version: 1.0.12 Last modified: Fri Aug 18 2023 06:23:24 GMT+0100 (British Summer
Time)