eu-us-dpf-assessment

Assessing the EU-US Data Privacy Framework

Overview

The European Commission adopted the adequacy decision for the EU-US Data Privacy Framework (DPF) on 10 July 2023, based on Commission Implementing Decision (EU) 2023/1795. This adequacy decision enables transfers of personal data from the EU/EEA to US organisations that have self-certified to the DPF with the US Department of Commerce (DoC), without the need for additional transfer mechanisms such as SCCs or BCRs. The DPF replaced the invalidated Privacy Shield framework and was designed to address the concerns raised by the Court of Justice in Schrems II (Case C-311/18) through the introduction of Executive Order 14086 limiting US signals intelligence activities.

DPF Adequacy Decision — Key Elements

Legal Basis

• Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to GDPR Art. 45(3)
• US Executive Order 14086 (7 October 2022) — Enhancing Safeguards for United States Signals Intelligence Activities
• Attorney General Regulation (29 June 2023) establishing the Data Protection Review Court (DPRC)
• UK Extension: The UK-US Data Bridge (effective 12 October 2023) extends DPF protections for UK-to-US transfers

Scope of Adequacy

The DPF adequacy decision applies only to transfers to US organisations that:

1. Have actively self-certified to the DPF with the Department of Commerce
2. Are subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) or the Department of Transportation (DoT)
3. Are listed on the DPF List maintained by the DoC at dataprivacyframework.gov

The adequacy decision does not cover transfers to:

• US government agencies
• US organisations that have not self-certified
• US organisations subject to regulators other than the FTC or DoT (e.g., banks regulated by the OCC, telecommunications carriers regulated by the FCC)

Self-Certification Process

Eligibility Requirements

1. The organisation must be subject to the jurisdiction of the FTC (under Section 5 of the FTC Act) or the DoT (under 49 USC).
2. The organisation must commit to comply with all DPF Principles.
3. The organisation must publicly disclose its DPF-compliant privacy policy.
4. The organisation must identify an independent recourse mechanism for handling complaints.
5. The organisation must pay the annual certification fee to the DoC.

Certification Steps

Step	Action	Timeline
1	Review DPF Principles and assess organisational readiness	2-4 weeks
2	Develop or update privacy policy to comply with DPF Principles	2-3 weeks
3	Select and engage an independent recourse mechanism (IRM)	1-2 weeks
4	Designate a contact person responsible for DPF compliance	1 week
5	Complete the self-certification application at dataprivacyframework.gov	1 week
6	Submit required documentation and privacy policy URL	1 week
7	Pay annual certification fee (scaled by revenue)	Upon submission
8	DoC review and listing on the DPF List	2-4 weeks after submission
9	Annual re-certification before expiry date	12 months after initial certification

Annual Certification Fee Schedule (2025)

Organisation Annual Revenue	Fee
Up to USD 5 million	USD 0 (fee waived for small organisations)
USD 5 million — USD 25 million	USD 575
USD 25 million — USD 500 million	USD 1,150
USD 500 million — USD 5 billion	USD 2,300
Over USD 5 billion	USD 3,450

DPF Principles

1. Notice Principle

Self-certified organisations must inform individuals about:

• The types of personal data collected
• The purposes of processing
• The right to access and correct data
• The type or identity of third parties to whom data may be disclosed
• The choices and means offered for limiting use and disclosure
• The independent recourse mechanism available
• The organisation's liability in cases of onward transfer to third parties

2. Choice Principle

Organisations must offer individuals the opportunity to opt out when personal data is:

• Disclosed to a third party (other than an agent acting on the organisation's behalf)
• Used for a purpose materially different from the purpose for which it was originally collected or subsequently authorised

For sensitive data (health, racial/ethnic origin, political opinions, religious beliefs, trade union membership, sex life, criminal record), affirmative express consent (opt-in) is required before disclosure or use for a new purpose.

3. Accountability for Onward Transfer Principle

Transfers to third-party controllers require:

• A contract stipulating the third party provides the same level of protection as the DPF Principles
• The third party notifies the organisation if it can no longer meet this obligation

Transfers to agents (processors) require:

• A contract restricting processing to specified purposes
• The agent provides the same level of protection
• The agent notifies the organisation and takes reasonable steps to stop and remediate unauthorised processing

4. Security Principle

Organisations must take reasonable and appropriate measures to protect personal data from loss, misuse, unauthorised access, disclosure, alteration, and destruction, taking into account the risks involved in processing and the nature of the data.

5. Data Integrity and Purpose Limitation Principle

Personal data must be:

• Relevant for the purposes of processing
• Reliable for its intended use
• Accurate, complete, and current
• Not processed in a way incompatible with the purposes for which it was collected or subsequently authorised

6. Access Principle

Individuals have the right to:

• Obtain confirmation of whether the organisation processes their data
• Have the data communicated to them within a reasonable time
• Challenge the accuracy of the data and have it corrected, amended, or deleted

Access may be restricted only in limited circumstances (e.g., where providing access would violate others' rights, where the burden or expense of providing access is disproportionate, or where disclosure would violate legal obligations).

7. Recourse, Enforcement, and Liability Principle

Organisations must provide:

• An accessible, independent, and affordable dispute resolution mechanism
• Procedures for verifying compliance with the DPF commitments
• Remediation of problems arising from non-compliance
• Consequences for the organisation if it fails to comply (sanctions by the FTC/DoT)

Data Protection Review Court (DPRC)

Structure

• The DPRC was established by the Attorney General Regulation of 29 June 2023 pursuant to Executive Order 14086.
• The DPRC is a two-tier review mechanism:
  • First tier: Civil Liberties Protection Officer (CLPO) at the Office of the Director of National Intelligence (ODNI) reviews complaints and issues binding determinations
  • Second tier: Data Protection Review Court reviews CLPO determinations upon application by the complainant or the intelligence community element

Process for EU Data Subjects

1. Data subjects submit complaints to their national data protection authority (SA).
2. The SA transmits the complaint to the EDPB Secretariat.
3. The EDPB Secretariat forwards the complaint to the US via the designated channel.
4. The CLPO investigates and determines whether a covered violation occurred.
5. If a violation is found, the CLPO directs appropriate remediation.
6. The complainant or the intelligence community element may apply for DPRC review.
7. The DPRC appoints a special advocate to represent the complainant's interests.
8. The DPRC issues a final, binding determination.
9. The outcome is communicated back through the same channel to the SA and the data subject.

Key Safeguards in Executive Order 14086

Safeguard	Description
Necessity standard	US signals intelligence collection must be necessary to advance a validated intelligence priority
Proportionality standard	Collection must be proportionate, balancing intelligence need against privacy impact
Prohibited purposes	Collection may not be conducted for suppressing dissent, disadvantaging persons based on ethnicity/race/religion, restricting freedom of the press, or gaining commercial competitive advantage
Bulk collection limits	Bulk collection permitted only for specific, enumerated objectives (e.g., counter-espionage, counter-terrorism); must be as tailored as feasible
Data retention limits	Personal data collected through signals intelligence must be deleted when no longer needed for the validated intelligence purpose
Binding nature	EO 14086 creates binding obligations enforceable through the DPRC

Annual European Commission Review

The adequacy decision requires periodic review by the European Commission in cooperation with the EDPB and the European Parliament:

• First review: Conducted in 2024, published October 2024 — Commission concluded the DPF continues to ensure an adequate level of protection
• Subsequent reviews: At least every four years
• Review elements: Compliance enforcement by the FTC/DoT, DPRC functioning, implementation of EO 14086, developments in US surveillance law, FISA Section 702 reauthorization status
• Power to suspend or repeal: The Commission may suspend or repeal the adequacy decision if the level of protection is no longer adequate

Verification Checklist for EU Data Exporters

Before relying on the DPF for a transfer, the EU data exporter must verify:

Check	Method
Importer is listed on the DPF List	Search dataprivacyframework.gov
Certification is active (not expired or withdrawn)	Check status and expiry date on the DPF List
Certification covers the relevant data categories	Review the organisation's DPF scope on the List (HR data, non-HR data, or both)
Importer is subject to FTC or DoT jurisdiction	Confirm regulatory jurisdiction in the DPF listing
Importer's privacy policy references DPF compliance	Review the published privacy policy at the URL listed
IRM identified	Confirm the independent recourse mechanism listed on the DPF entry
Data transfer falls within the scope of the adequacy decision	Confirm the transfer is to a self-certified organisation and not to a non-certified entity

Risk Considerations and Ongoing Monitoring

Legal Stability Risks

• FISA Section 702: Reauthorised through April 2026; future legislative changes could affect the DPF adequacy assessment
• Judicial challenges: Privacy advocacy groups (notably noyb) have indicated the possibility of challenging the DPF before the CJEU, similar to the Schrems I and Schrems II proceedings
• Political risk: A change in US administration could affect the continued implementation of EO 14086

Mitigation Strategies

1. Dual mechanism approach: Maintain executed SCCs as a backup mechanism for US transfers alongside DPF reliance, enabling rapid switching if the adequacy decision is suspended or invalidated.
2. Monitoring programme: Track EC review outcomes, CJEU case filings, and US legislative developments.
3. Contractual safeguards: Include DPF-specific termination and data return clauses in contracts with US importers, triggered by adequacy decision invalidation.
4. Transfer register documentation: Record DPF as the transfer mechanism with the importer's DPF List entry date and re-certification schedule.