So, should all U.S.-based companies that receive personal data relating to EU individuals go and join the new framework? Not necessarily. The DPF may not be the most suitable solution for every data transfer scenario.

To be able to join the DPF, a company or organization must be subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC), the Department of Transportation (DOT), or another statutory body recognized by the EU. Businesses and organizations that fall outside the FTC's or DOT's authority will therefore not be eligible to participate in the new framework.
Also, companies that want to rely on the new framework will have to publicly commit to comply with the DPF principles issued by the U.S. Department of Commerce and be able to demonstrate their compliance with these principles. There are seven key DPF principles that apply to every participating company and impose detailed data protection obligations, such as requirements around purpose limitation, data minimization, and data retention, in addition to obligations relating to data security and the sharing of (transferred) personal data with third parties. There are also 16 supplemental principles that may apply, depending on the data transfer scenario—for example, in the case of human resources data or if personal data from clinical trials conducted in the EU is transferred to the U.S. In order to ensure their adherence to the DPF principles, participating companies will have to implement a range of framework-specific compliance measures, such as:
- DPF privacy notices to EU individuals whose personal data is transferred to the U.S. These notices will have to inform individuals about, for example, why the company collects and uses their personal data and to whom it may disclose the data.
- Mechanisms for ensuring that EU individuals can access the personal data processed about them, and that they can correct, amend, or delete personal data that is inaccurate or processed in violation of the DPF principles.
- Readily available, independent recourse mechanisms to investigate EU individuals' complaints and disputes, at no cost to the individuals.
- Onward transfer contracts with third parties that will be processing transferred data as independent controllers or as processors of the DPF-certified company.
- Internal procedures for verifying their own compliance with the DPF (through self-assessments or external compliance reviews).

U.S. companies' compliance with the DPF principles will be monitored and enforced by the FTC and DOT, which have an arsenal of remedies they can use in charging violations.

Instant Insights /

Did Transferring Personal Data from the EU to the U.S. Just Get Easier?

Related Stories

Recommended For You