EU-U.S. Data Privacy Framework Approved, Streamlines Data Transfers to the U.S.

WASHINGTON, D.C., July 10, 2023 – VeraSafe, a leading data privacy consulting firm, welcomes the European Commission’s approval of the EU-U.S. Data Privacy Framework (DPF). This marks a significant milestone in facilitating the seamless flow of personal data from the European Union to the United States. Up to now, organizations operating in the EU encountered legal uncertainties and faced arduous compliance requirements when transferring personal data from the EU to the U.S. Similarly, U.S. organizations were confronted by significant obstacles in receiving personal data regulated by the General Data Protection Regulation (GDPR) of the European Union. However, with the implementation of the DPF, these challenges have been alleviated, leading to improved efficiency for businesses operating in full compliance with the framework.

Previously, the transfer of personal data from many countries in Europe to the U.S. was facilitated by the Safe Harbor framework, succeeded by the Privacy Shield framework. Under these frameworks, personal data could be transferred to businesses in the U.S. that were certified under those frameworks. However, the Safe Harbor framework was invalidated in 2015 by the Court of Justice of the European Union (CJEU) in a case initiated by privacy activist Max Schrems. Subsequently, the EU and U.S. introduced the Privacy Shield framework to address the concerns raised by the CJEU and ensure the uninterrupted flow of personal data to the U.S. Unfortunately, in 2020, the Privacy Shield met a similar fate when it was invalidated by the CJEU in a case informally referred to as “Schrems II.”

Following earnest negotiations and eager anticipation, the European Commission has now approved the EU-U.S. Data Privacy Framework (DPF). It has recognized the U.S. as providing an adequate level of protection for personal data transferred to DPF-certified organizations. This milestone signifies a positive step towards enabling smooth compliant data transfers between the EU and the U.S.

“This represents an exciting and pivotal moment for businesses that have been navigating through significant uncertainty,” states Matthew Joseph, Managing Director at VeraSafe. “Following the Schrems II ruling, organizations were burdened with additional complex requirements to maintain the legality of their personal data transfers to the U.S. The associated legal and operational costs placed a substantial strain on businesses. However, the introduction of the new DPF brings much-needed relief to them.”

Joseph highlights the efforts made by the U.S. to address the concerns raised in Schrems II. “Notably, the U.S. has implemented a comprehensive two-tier redress system to handle complaints from individuals who believe that the U.S. has violated the law in the course of carrying out intelligence gathering through the interception of electronic signals and communications”.

To benefit from the DPF, businesses must undergo certification based on the framework’s requirements. Joseph emphasizes, “The certification process should be relatively seamless for businesses that were previously certified under the Privacy Shield. However, other organizations should not be daunted by the process.” 

Drawing from experience in facilitating Privacy Shield certification for hundreds of businesses, VeraSafe is well-equipped to assist organizations with certification under the DPF’s requirements. According to Joseph, VeraSafe empowers organizations to facilitate personal data transfers under the DPF by providing tailored solutions. This includes comprehensive DPF compliance assessments, the creation and review of compliant privacy notices and policies, privacy and security training, as well as guidance for DPF certification. 

After conducting an assessment, VeraSafe delivers a detailed compliance verification report that meticulously documents how a business satisfies each criterion of the DPF. This report serves as evidence for third parties, demonstrating that the organization securely manages personal data in accordance with the DPF’s requirements. Furthermore, VeraSafe offers an Independent Recourse Mechanism. This is a dispute resolution service for organizations that seek to fulfill their obligations as DPF participants and offer their customers an unbiased, professionally staffed forum for the amicable mediation of privacy-related complaints.

Joseph highlights the importance for organizations seeking DPF certification to engage the services of an experienced provider, such as VeraSafe. According to him, navigating the certification process requires expertise and guidance to ensure a smooth and successful outcome. An organization’s stakeholders will rest easy knowing that advice was sought from deeply experienced professionals, and that a rigorous compliance assessment was completed. Joseph cautions: “Compliance with the DPF requirements involves time consuming legal and technical research. VeraSafe allows an organization to focus on its core business and can answer complex DPF related questions with confidence. The team of highly skilled and seasoned professionals at VeraSafe approach each organization’s DPF certification process with a strategic mindset. Their expertise ensures that the certification process is meticulously handled, providing organizations with the guidance and support needed to navigate the requirements of the DPF effectively.”

VeraSafe encourages all companies that are involved in the transfer of personal data from Europe to the U.S. to consider the benefits of being certified to the DPF. Learn more about VeraSafe’s DPF services by visiting https://verasafe.com/privacy-solutions/data-privacy-framework. 

About VeraSafe

VeraSafe’s mission is to provide the world’s best data protection advice, with a human touch. Headquartered in Washington D.C. with group companies in key jurisdictions, VeraSafe boasts a diverse, global team of passionate privacy professionals, IT security experts, and privacy compliance attorneys. Along with in-depth knowledge of privacy law, VeraSafe offers comprehensive data protection and privacy consulting services to businesses of all sizes, from startups to Global Fortune 10. For more information, visit www.verasafe.com.