EU-US data deal opens a certified route, with limits

The European Commission adopts a new basis for EU–US personal-data transfers on 10 July, three years after the Court of Justice struck down Privacy Shield. The Data Privacy Framework lets European organisations send covered personal data to participating US recipients without adding a separate international-transfer safeguard, such as standard contractual clauses.

File photo: European flags. © Håkan Dahlström, Spain, 2010. Original photograph, CC BY 2.0, via Wikimedia Commons. Resized and cropped. This isn’t the July 2023 decision.

The important boundary runs through the receiving organisation. The decision covers companies on the US Department of Commerce’s Data Privacy Framework List. It doesn’t grant every US service the same status. Separately, the new US intelligence safeguards extend to transfers made using other GDPR mechanisms, including standard contractual clauses.

Certification attaches to the recipient

The adopted decision sets two gates. An organisation must fall within the investigatory and enforcement powers of the Federal Trade Commission or Department of Transportation. It can receive data under the framework from the date Commerce places it on the list, and must renew its certification annually. A first-time applicant can’t publicly claim adherence before Commerce accepts its completed submission and lists it.

Scope matters within a company, too. Certification submissions identify the personal data covered and the purposes of processing. Where a submission includes several entities or subsidiaries, Commerce is to check their privacy policies. A familiar corporate name alone doesn’t establish that a particular recipient and transfer are covered.

The decision also contains a specific exclusion: personal data collected for publication, broadcasting or other public communication of journalistic material, whether ultimately used or not, and information in previously published material distributed from media archives. Those categories fall outside the framework’s principles and can’t be transferred on its basis. The exclusion concerns that information, not every transfer by a media company; it isn’t a general prohibition on journalistic transfers.

European exporters still have their ordinary GDPR obligations, including purpose limitation, data minimisation, transparency and security. The decision also leaves the GDPR’s direct application to US organisations intact wherever its territorial-scope conditions are met.

The protection follows subcontracting

For software buyers, the framework’s onward-transfer rules reach beyond the first US provider. Transfers from a participating organisation to another controller or processor generally need limited, specified purposes and a contract requiring the same level of protection as the framework’s principles. For transfers between controllers within a controlled corporate group, other instruments can provide continuity of protection instead of a separate contract. That flexibility doesn’t remove the contract required when an EU controller sends data to a US processor, even a certified one.

A separate exception covers occasional operational needs involving a small number of employees, such as booking flights or hotel rooms. It permits transfers to third-party controllers without that onward-transfer contract or the Access Principle, provided the participating organisation complies with the Notice and Choice Principles. It isn’t a general exemption for subcontracting.

These obligations follow further transfers regardless of whether the next recipient is in the US or another country. A processor must act on instructions; the participating organisation must take reasonable steps to check its compliance and stop or remedy unauthorised processing. The next supplier doesn’t simply inherit the first supplier’s certification.

This makes two checks relevant to a cloud-service contract: whether the initial recipient is covered, and how its subsequent processing chain is governed. The adequacy decision simplifies the international-transfer basis while leaving those contractual responsibilities in place.

Redress has a wider reach, with confidential outcomes

The Commission’s 10 July questions and answers says the US national-security safeguards, including the redress mechanism, apply to GDPR transfers to US companies regardless of the transfer tool used. Under the new US executive-order rules, signals intelligence activities must be necessary and proportionate to defined national-security objectives. Companies relying on standard contractual clauses or binding corporate rules also benefit from the safeguards, but still need to meet the requirements of their chosen transfer tool.

The national-security redress route set out in the decision starts with a complaint to a competent European data protection authority, passed through the European Data Protection Board to the US intelligence community’s Civil Liberties Protection Officer. A complainant needn’t prove that intelligence agencies actually collected their data, but must supply basic information supporting the alleged violation. The design provides for review by the Data Protection Review Court, a tribunal established by the US Attorney General, with power to issue binding remedies, including deletion of unlawfully collected data.

The notification sent back to the complainant is deliberately limited, both after the initial investigation and after a court review requested by the complainant. The decision specifies a notification saying the review either found no covered violation or required appropriate remediation. It doesn’t promise to disclose which of those happened. Commerce must check at least every five years whether information about the court’s review has been declassified, so the person can be told that further information may be available.

Adoption establishes the legal route; its operation still faces scrutiny. The Commission plans a first review within a year to examine implementation and practical effectiveness. In contemporary reporting by IAPP, privacy group noyb says it will challenge the arrangement, while Justice Commissioner Didier Reynders defends the new safeguards. Those are competing assessments of its durability, not a court ruling on this decision.

The framework also follows May’s order concerning Meta’s Facebook data transfers, which separated future transfers from data already held in the US. The adoption supplies a new transfer basis for eligible recipients; the decision doesn’t itself announce the resolution of that separate enforcement case.