In the words of the European Commissioner for Justice, Didier Reynders:
“The adoption of this adequacy decision is the final step to ensure safe and free transfers of data across the Atlantic. It ensures the protection of individual rights in our intangible and interconnected digital world, where physical borders do not matter much anymore.”

The basic aspects of the new Adequacy Decision for the EU-US Data Privacy Framework are:

• US companies wishing to join the EU-US Data Privacy Framework must commit to a detailed set of privacy obligations, including the obligation to delete personal data when it is no longer needed and to ensure that personal data continues to be protected even when it is shared with third parties (see, for example, pp.10-11 of the Adequacy Decision).
• US companies involved in the processing of personal data transferred from the EU to the USA have to certify their compliance with the US Department of Commerce’s standards (see, for example, pp.11-12 of the Adequacy Decision).
• In cases where EU citizens’ personal data has been mishandled by US companies, EU citizens will have numerous redress avenues to choose from, including independent dispute resolution mechanisms and arbitration panels, without incurring any charges (see, for example, pp.17-22 of the Adequacy Decision).
• US public authorities may access personal data in cases of criminal law enforcement (pp.23-34 of the Adequacy Decision) and national security purposes (pp.34-59 of the Adequacy Decision) – this access is limited in the ambit of the principles of necessity and proportionality.
• EU citizens will have access to an independent and impartial redress mechanism relating to data access by US intelligence authorities through a newly established Data Protection Review Court (DPRC), which will investigate and resolve complaints and which will have the authority to adopt binding remedial measures (pp.52-59 of the Adequacy Decision).
• Other tools such as standard contractual clauses and binding corporate rules also form part of this Adequacy Decision.

 As President Ursula von der Leyen stated, “The new EU-U.S. Data Privacy Framework will ensure safe data flows for Europeans and bring legal certainty to companies on both sides of the Atlantic.”

The new EU-US Data Privacy Framework will be subject to periodic reviews by the EU and US authorities, with the first review expected to take place by July 2024, in order to ensure that all elements of the Adequacy Decision have been comprehensively implemented in the US legal system and are effectively monitored.

“The new adequacy decision will provide legal certainty for businesses and will help further consolidate the EU as a powerful player in transatlantic markets, while remaining uncompromising on respecting fundamental right of Europeans for their data to be always protected.” ~ Věra Jourová, Vice-President of the European Commission for Values and Transparency

ServPRO is Your One-Stop-Shop for Professional Services.

ServPRO is a well-established team of accountants, auditors, advocates and consultants in Cyprus. Our areas of expertise are Accounting & Finance, Advisory & Consulting, Audit & Assurance, Corporate & Legal, Economic Substance and Taxation.

Our team has a stellar track record in delivering practical solutions to corporate and individual clients with a spherical, solution-driven and detail-oriented approach, while demonstrating an aptitude of professionalism, integrity and commercial acumen.

Contact us today for an initial, complimentary consultation with us.

For more information on this topic contact us by telephone (+35722021100) or email (info@servpro.com.cy).