In July 2023, the European Commission adopted its adequacy decision (the “Adequacy Decision”) for the EU-U.S. Data Privacy Framework (the “DPF”). The DPF is a mechanism that facilitates cross-border transfers of personal data from the European Union to the United States in compliance with European Union law. The adoption of the Adequacy Decision came after years of negotiations between the European Union and the United States to reestablish a mechanism for such transfers following the invalidation of the EU-U.S. Safe Harbor and the EU-U.S. Privacy Shield by the European Court of Justice in 2015 and 2020, respectively.

The Adequacy Decision concludes that the United States provides an adequate level of protection for personal data transferred from the European Union to United States companies certified to the DPF, comparable to the level of protection afforded to European companies under European Union law. Under the DPF privacy principles, personal data is defined as “data about an identified or identifiable individual that are within the scope of the General Data Protection Regulation received by an organization in the United States from the European Union, and recorded in any form.” Pursuant to this decision, personal data is able to flow freely from the European Union to participating United States entities without the implementation of additional data protection safeguards. To participate, companies must self-certify and publicly commit to comply with the EU-U.S. DPF principles, which are enforceable under United States law. The U.S. Department of Commerce estimates that EU-U.S. data flows support more than $1 trillion in trade and investment annually, and the DPF will now offer an affordable and streamlined mechanism to support growth for all U.S. businesses.

On September 21, 2023, the United Kingdom and the United States announced the “U.K. Extension” to the DPF, also referred to as the “U.K.-U.S. Data Bridge.” The U.K.-U.S. Data Bridge similarly allows the free flow of personal data from the United Kingdom to United States entities participating in the DPF without the need for additional, often costly, data protection safeguards. This extension took effect on October 12, 2023.

Companies can now take advantage of this streamlined process for moving data from the U.K. to the U.S; however, it is important that existing arrangements between U.K. and U.S. partners are carefully analyzed, as some relationships and categories of business do not qualify to take advantage of the U.K. Extension. It also is critical to categorize data as some may still require additional procedures and protections. But for those who do qualify, they can enjoy greater efficiency, cost savings, and potential growth opportunities.

This Client Alert has been prepared by Tucker Ellis LLP for the use of our clients. Although prepared by professionals, it should not be used as a substitute for legal counseling in specific situations. Readers should not act upon the information contained herein without professional guidance.