20
Sat, Apr
44 New Articles

New EU–US Data Privacy Framework – Simplified Data Transfer to the US

New EU–US Data Privacy Framework – Simplified Data Transfer to the US

Hungary
Tools
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

With the Schrems II judgment, which invalidated the Privacy Shield, the CJEU (Court of Justice of the European Union) make it more difficult to comply with the GDPR for companies transferring personal data from the EU to the US. However, the new EU-US Data Privacy Framework (or “Framework”) adopted on 10 July aims to put an end to this situation. But how does the Framework make data transfers between the EU and US easier? In this short article, we explain the basics of the new Framework and answer the above question.

Background

Based on the adequacy decision that preceded the new EU-US Data Privacy Framework, the so-called Privacy Shield, adopted in 2016, US companies could register under the Privacy Shield and once they did so, the European Commission recognised that the US provided adequate protection for personal data transferred to such companies. This meant that no additional safeguards were needed for data transfers to such companies.

However, the CJEU, in the 2020 Schrems II judgment, invalidated the Privacy Shield stating that US laws did not provide adequate protection, in particular, due to the excessive rights of the national security organisations and lack of appropriate legal remedies.

In the absence of the adequacy decision, parties making such transfers should have applied a complex set of rules providing other additional safeguards, most commonly the standard data protection clauses adopted by the European Commission.

However, following the negotiations between EU and the US, the US passed a legislation aimed at addressing the problems identified in the Schrems II judgment.

EU – US Data Privacy Framework

After the above-mentioned legislation, the European Commission concluded that the US now ensures an adequate level of protection for personal data transferred from the EU to companies participating in the EU-US Data Privacy Framework.

The Commission has based its decision on the following.

The Framework, by adopting new set of rules and binding safeguards, limits access to EU data by US intelligence services to what is necessary and proportionate.

Moreover, the new Framework provides access for EU citizens to an independent and impartial redress mechanism regarding the collection and use of their data by US intelligence agencies, which includes a newly created Data Protection Review Court (DPRC).

Based on the above, personal data can be transferred to US companies participating in the EU-US Data Privacy Framework without being subject to any further conditions or authorisations. Consequently, the transatlantic data transfers may be based on solely on the Framework, instead of the currently used standard contractual clauses.

Certification of the US companies

It is noted that to participate in the Framework, US companies, shall, of course, comply with Framework, and, similar to the previous Privacy Shield, make a certification application to be added to the “Data Privacy Framework List”.

Once the US organisation are placed in the above-mentioned List, it can receive personal data on the basis of the Framework.

Moreover, US companies, who are already registered in the previous Privacy Shield, can rely immediately on the Framework but they shall also take actions to comply with the new Framework until 10 October 2023, for instance, they need to update their privacy policies.

Summary

After the invalidation of the Privacy Shield, the situation for companies that transfer a personal data to the US has become more difficult, as companies should apply specific data protection clauses to each transfer to the US.

However, the recently adopted EU – US Data Privacy Framework remedied the problems identified in the Schrems II judgment, subsequently, according to the European Commission, the US now provides the effective legal protection as well as the right to an adequate judicial remedy for those whose personal data are made available to US national security organisations.

The adoption of Framework significantly makes it easier to transfer personal data from the EU to the US, as a certified US company can receive personal data from the EU solely based on the Framework instead of the currently used standard contractual clauses.

However, it is noted that US companies, can only use the Framework if they apply for certification and they are added to the Data Privacy Framework List.

Those US companies, who are already registered in the previous Privacy Shield, are in a better position as they can rely immediately on the Framework, but they shall also take actions to comply with the new Framework until 10 October 2023.

By Peter Korozs, Junior Associate, SmartLegal Schmidt & Partners

Hungary Knowledge Partner

Nagy és Trócsányi was founded in 1991, turned into limited professional partnership (in Hungarian: ügyvédi iroda) in 1992, with the aim of offering sophisticated legal services. The firm continues to seek excellence in a comprehensive and modern practice, which spans international commercial and business law. 

The firm’s lawyers provide clients with advice and representation in an active, thoughtful and ethical manner, with a real understanding of clients‘ business needs and the markets in which they operate.

The firm is one of the largest home-grown independent law firms in Hungary. Currently Nagy és Trócsányi has 26 lawyers out of which there are 8 active partners. All partners are equity partners.

Nagy és Trócsányi is a legal entity and registered with the Budapest Bar Association. All lawyers of the Budapest office are either members of, or registered as clerks with, the Budapest Bar Association. Several of the firm’s lawyers are admitted attorneys or registered as legal consultants in New York.

The firm advises a broad range of clients, including numerous multinational corporations. 

Our activity focuses on the following practice areas: M&A, company law, litigation and dispute resolution, real estate law, banking and finance, project financing, insolvency and restructuring, venture capital investment, taxation, competition, utilities, energy, media and telecommunication.

Nagy és Trócsányi is the exclusive member firm in Hungary for Lex Mundi – the world’s leading network of independent law firms with in-depth experience in 100+countries worldwide.

The firm advises a broad range of clients, including numerous multinational corporations. Among our key clients are: OTP Bank, Sberbank, Erste Bank, Scania, KS ORKA, Mannvit, DAF Trucks, Booking.com, Museum of Fine Arts of Budapest, Hungarian Post Pte Ltd, Hiventures, Strabag, CPI Hungary, Givaudan, Marks & Spencer, CBA.

Firm's website.

Our Latest Issue