Pittsburgh, PA
Firm Alert
(by Ember Holmes and Justine Kasznica)
On July 10, 2023, the European Commission (EC) adopted the European Union-United States Data Privacy Framework (DPF), an adequacy decision concluding that the U.S. has adequate data privacy and security infrastructure in place for secure transfer of personal data from the European Economic Area (EEA), which is comprised of the 27 European Union Member States, Norway, Iceland, and Liechtenstein, into the U.S. Prior to the adoption of the DPF, in order to transfer data from the EEA to the U.S., organizations in the U.S. were required to use one of the EC-approved safeguards, such as standard contractual clauses or binding corporate rules. These safeguards, set forth in Article 46 of the General Data Protection Regulation (GDPR), are onerous and complicated. The DPF allows for the safe and secure flow of data for U.S. multinational corporations and organizations doing business with those in the EEA. The importance of this data flow cannot be overstated – organizations across all sectors, whether large or small, will have equal opportunity to participate in the digital economy and to engage in streamlined international commerce.
There are three branches of the DPF – the EU-U.S. DPF, the Swiss-U.S. DPF, and the UK Extension to the EU-U.S. DPF. With the July adoption of the EU-U.S. DPF by the EC, the EU-U.S. DPF permits flow of information from the E.U. to the U.S. The Swiss-U.S. DPF and UK Extension to the EU-U.S. DPF will enable personal data transfers from those jurisdictions if and when the Swiss and UK Governments officially recognize the adequacy decision.
In the U.S., the DPF is implemented and administered by the U.S. Department of Commerce (DOC), and on July 17, 2023, the DOC launched the Data Privacy Framework program website. …