The EU-U.S. Data Privacy Framework is now fully effective. U.S. companies that participate in the DPF are deemed to provide an adequate level of protection for personal data transfers received from the EU within the meaning of the EU General Data Protection Regulation. Some companies may be asking why this matters.
Why should my company join DPF?
There is no one-size-fits-all answer to this important question. Companies differ with respect to business operations, risk tolerance and existing global privacy program configuration. The DPF offers some key advantages, as well as some key disadvantages. All eligible U.S. companies should bear these elements in mind when evaluating the question. Notably, the U.S. Department of Commerce now also maintains comparable programs for the United Kingdom (the U.K. Extension of DPF) and Switzerland (the Swiss-U.S. DPF). These programs are essentially equivalent to the EU version, such that the considerations outlined in this note should generally apply to personal data transfers to the U.S. from the U.K. and Switzerland.
Key advantages
Advantage 1: Your company's participation in DPF would address the GDPR legal requirement to protect cross-border personal data transfers from the EU to the U.S.
In general, GDPR Articles 44-49 prohibit the transfer of personal data from the EU to a third country, such as the U.S., unless the third country assures a level of protection guaranteed by GDPR. Depending on the data flows, your company should have several options to address this requirement, such as:
- Assuring that such cross-border transfers fall within the scope of a European Commission adequacy decision under GDPR Article 45, e.g., DPF in the U.S., and similar adequacy determinations for other jurisdictions.
- Implementing the European Commission standard contractual clauses for transfers to third countries under GDPR Article 46.
- Assuring that the transfers fall within the scope of a group company set of binding corporate rules that have been approved by EU data protection authorities under GDPR Article 47.
- Confirming the application of various narrow derogations under GDPR Article 49.
As noted above, the European Commission has issued an adequacy decision for the DPF. This means that personal data transfers from the EU to U.S. companies participating in the DPF are deemed adequate without any specific authorization. Companies using the DPF do not need to implement SCCs between the EU data exporter and the U.S. data importer, go through the BCR approval process, or try to fit their data transfers within the narrow derogations.
Advantage 2: Your company's EU customers, affiliates or other business partners may want you to participate in DPF.
The GDPR legal obligation to address the cross-border transfer restriction falls primarily on the company in the EU that would engage in (or permit) such transfer to you in the U.S. Depending on your data flows, this may mean your EU customers, affiliates or other business partners bear the primary responsibility to assure adequacy when they send personal data to your company. As outlined above, your EU business partners have four key options to consider. Some of them may want you to participate in the DPF, as it may pose less administrative burden and risk for them.
From a commercial perspective, the most significant alternative to the DPF are SCCs.
Virtually all companies that participate in trans-Atlantic commerce have already implemented these standard terms over the years. This is particularly the case in recent years since the predecessor to the DPF, the EU-U.S. Privacy Shield, was held to be invalid by the Court of Justice of the European Union in its "Schrems II." At that time, many companies relying on Privacy Shield ended up switching to use the then-existing version of European Commission standard clauses (now replaced by the new SCCs as linked above).
Although familiar, the SCCs are not always easy. The parties still need to implement them properly. In part due to "Schrems II," Article 14 in the SCCs require the parties to engage in a transfer impact assessment for the covered data flows.
To support the European Commission's adequacy decision for DPF, the U.S. addressed the concerns in "Schrems II" by, among other efforts, adopting Executive Order 14086 and related regulations governing the new Data Protection Review Court. As noted in guidance from the European Data Protection Board, transfers to U.S. companies participating in DPF should therefore not need to undergo a separate TIA process to evaluate supplementary measures and the like.
In contrast, companies relying on SCCs must still conduct and document a TIA as per Article 14 in the SCCs. Although such companies can cite to the substantive and procedural protections in the executive order, the DPRC, and related provisions in support for their TIA assessments, it still is an administrative burden to prepare the TIAs, and it may be difficult to eliminate the risk that such assessments are not be acceptable to the authorities in particular cases.
Advantage 3: Your company may find it easier to engage with EU customers, EU affiliates or other EU business partners.
For many of the same reasons mentioned above, your company may find it easier to participate in the DPF than to engage in SCC implementations, including TIAs, with EU customers, EU affiliates or other EU business partners. The ease of administrative burden associated with third party contracting alone may be quite useful. Notably, this advantage may be limited to the extent that your company is receiving personal data transfers outside the U.S., such as directly in Costa Rica, India, Thailand, or other jurisdictions, that would require SCCs and a TIA anyway.
Advantage 4: Your company may find various other benefits to participation.
The company may find that participation in DPF helps demonstrate to your EU customers and prospects that you take the GDPR seriously. You might also find that DPF provides a nice baseline for your company’s global data privacy compliance program, particularly given the proliferation of comprehensive state privacy laws and associated privacy assessments and due diligence activities emerging in the U.S.
Key disadvantages
Disadvantage 1: Your company would be subject to U.S. Federal Trade Commission enforcement authority for your processing of EU personal data in accordance with the DPF rules.
To participate in DPF, companies need to establish an independent dispute resolution mechanism and take other steps, including attesting that it is subject to the FTC authority for purposes of enforcement of the DPF rules. Since the FTC has already expressed its commitment to enforce the DPF, and the FTC is generally aggressive with its privacy enforcement actions, this is an important consideration.
Disadvantage 2: Your company would need to conduct the due diligence necessary to assure and document adherence to the DPF.
From a commercial privacy perspective, the DPF is not materially different or more stringent than its predecessor, the Privacy Shield. However, if your company has not previously undertaken this kind of exercise, it will require due diligence and effort to confirm your data flows and information security measures, and otherwise align your privacy policies, statements and practices.
Disadvantage 3: The DPF might at some point be held invalid by the CJEU.
It is possible that, as with its predecessor the Privacy Shield, and the original trans-Atlantic arrangement, Safe Harbor, the CJEU may find other concerns around government surveillance or otherwise and deem the DPF invalid.
Indeed, several legal challenges are already underway. If the DPF is invalidated, at that time, companies would need to switch to SCCs or another regulatory solution. Although this is a risk, there are reasons to be optimistic that the CJEU would uphold the DPF upon challenge. The DPF is supported by enhancements in U.S. law and policy on government surveillance (as noted above). It also seems that broader geopolitical issues should drive the CJEU to consider the importance of closer integration and comity between Europe and the U.S. on commercial and noncommercial matters.
Next steps
At the end of the day, each U.S. company needs to make a strategic decision based on its own business operations, data flows, risk tolerance and existing global privacy program fundamentals.
The DPF should be viable in the short-to-medium term and provide some relative advantages over SCCs that should be considered. Longer term, the U.S., European Commission and other administrations should begin to pursue a trans-Atlantic data transfers, and establish a more durable long-term framework that provides more certainty for global commerce and more protection for individual privacy rights.
