eu-us-dpf-assessment
Installation
SKILL.md
Assessing the EU-US Data Privacy Framework
Overview
The European Commission adopted the adequacy decision for the EU-US Data Privacy Framework (DPF) on 10 July 2023, based on Commission Implementing Decision (EU) 2023/1795. This adequacy decision enables transfers of personal data from the EU/EEA to US organisations that have self-certified to the DPF with the US Department of Commerce (DoC), without the need for additional transfer mechanisms such as SCCs or BCRs. The DPF replaced the invalidated Privacy Shield framework and was designed to address the concerns raised by the Court of Justice in Schrems II (Case C-311/18) through the introduction of Executive Order 14086 limiting US signals intelligence activities.
DPF Adequacy Decision — Key Elements
Legal Basis
- Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to GDPR Art. 45(3)
- US Executive Order 14086 (7 October 2022) — Enhancing Safeguards for United States Signals Intelligence Activities
- Attorney General Regulation (29 June 2023) establishing the Data Protection Review Court (DPRC)
- UK Extension: The UK-US Data Bridge (effective 12 October 2023) extends DPF protections for UK-to-US transfers