On 10 July, the final pieces fell into place to create a new lawful basis for transferring personal data from the EU to the U.S., implementing the EU-U.S. Data Privacy Framework. Chair of Law and Ethics at the Georgia Tech School of Cybersecurity and Privacy Peter Swire, CIPP/US, explores what he called an “essential element of putting the DPF into operation,” U.S. Attorney General Merrick Garland’s designation of the EU and European Economic Area as “qualifying states.”
The European Data Protection Board adopted an information note on data transfers under the DPF. EDPB Chair Anu Talus said the note explains individuals’ rights and organizations’ obligations. “The EDPB will continue to pay special attention to the correct implementation of this new instrument and we look forward to contributing to the first review of the DPF next year,” she said. The EDPB also adopted a statement on the first review of the EU’s adequacy decision with Japan.
During a meeting at the U.S. Department of Justice, U.S. Attorney General Merrick Garland, Secretary of Commerce Gina Raimondo and European Commissioner for Justice Didier Reynders welcomed the finalized framework. Raimondo said it reflects a “joint commitment to promoting economic opportunity while protecting individual privacy rights,” while Reynders said it “guarantees the fundamental right of Europeans for the protection of their personal data and brings legal certainty for companies on both sides of the Atlantic.”
The IAPP updated its “EU-US Data Privacy Framework — Guidance and Resources” page in the IAPP Resource Center. The page includes the latest documents and announcements on the new framework, adopted 10 July, as well as analysis and additional resources, including what comes next as the DPF takes effect.Â