On July 10, 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework (DPF), which concludes that the US ensures a level of protection essentially equivalent to that of the EU for personal data transferred under the EU-US DPF from a controller or a processor in the EU to certified organizations in the US. 

In response, various privacy authorities, organizations, and stakeholders have issued their reactions to the adequacy decision. OneTrust DataGuidance Research tracks the reactions below.

NOYB

None of Your Business (NOYB) released, on July 10, 2023, a press release anticipating its intention to challenge the adequacy decision. In this regard, NOYB noted its opinion that the EU-US DPF is largely similar to the EU-US Privacy Shield Framework and that there is little change in US law, highlighting that the fundamental problem with Section 702 of the Foreign Intelligence Surveillance Act (FISA) was not addressed by the US.

You can read the press release here.

EDPB

The European Data Protection Board (EDPB) published, on July 10, 2023, on Twitter, the comments of its Chair, Anu Talus, who stated that "[t]he EDPB takes note that the EU-US DPF has been adopted and looks forward to the participation in its next plenary meeting to shed light on the adequacy decision and on the changes following the EDPB opinion."

You can read the statement here.

Update: July 11, 2023

BfDI

On July 10, 2023, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) issued a statement on the Commission's adequacy decision for the EU-US DPF. The BfDI highlighted its participation in drafting the EDPB's opinion on the draft adequacy decision in February 2023.

You can read the press release, only available in German, here.

CNIL

On July 11, 2023, the French data protection authority (CNIL) published a statement on the Commission's adequacy decision for the EU-US DPF. CNIL highlighted that transfers of personal data from the EU to organizations that are certified can be carried out freely, without specific supervision by Standard Contractual Clauses (SCCs) or another instrument. Further, CNIL noted that it will publish additional information on the EU-US DPF soon.

You can read the press release, only available in French, here.

FDPIC

On July 10, 2023, the Federal Data Protection and Information Commissioner (FDPIC) released a press release taking note of the adequacy decision. In particular, the FDPIC highlighted that Switzerland has also been in the process of concluding a Swiss-US Data Privacy Framework with the US, and that this should take place between Switzerland and the US within a few months after the conclusion of the EU-US DPF. Until such a framework is concluded, the FDPIC noted that Switzerland's adequacy list will remain unchanged.

You can read the press release here.

White House

On July 10, 2023, the White House issued a statement welcoming the Commission's adequacy decision for the EU-US DPF. The White House noted the adequacy decision reflects a joint commitment to data privacy protections and or greater economic opportunities for countries and organizations in Europe and the USA.

You can read the press release here.

Norway

On July 10, 2023, the Norwegian data protection authority (Datatilsynet) issued a statement welcoming the Commission's adequacy decision. The Datatilsynet noted that organizations must still follow other rules provided under the Law on the Processing of Personal Data of 15 June 2018, including having a valid legal basis, and a data processing agreement for sharing personal data with others. 

In addition, the Datatilsynet published Q&As about the transfer of personal data to the US. Among other things, the Datatilsynet noted that the Commission's adequacy decision only covers certified US businesses, while highlighting that the adequacy decision will also facilitate the transfer of personal data to non-certified US businesses. The Datatilsynet outlined that the adequacy decision will most likely be challenged in the Court of Justice of the European Union (CJEU), creating a risk that the new rules will be repealed. In this regard, the Datatilsynet pointed out that, while it is unknown whether such risk will materialize, organizations should be aware of it.

You can read the press release and the Q&A, only available in Norwegian, here. 

Denmark

The Danish data protection authority issued a press release on the Commission's adequacy decision, including some Q&As on the EU-US DPF. In particular, the Datatilsynet outlined that it will update its resources accordingly, including the guidelines on cloud and transfer of personal data to third countries.

You can read the press release and the Q&A, only available in Danish, here.

U.S. Department of Commerce

On July 10, 2023, U.S. Secretary of Commerce, Gina Raimondo, issued a statement regarding the Commission's adequacy decision for the EU-US DPF. In particular, the U.S. Secretary of Commerce Gina Raimondo welcomed the adequacy decision, noting that transatlantic data flows underpin more than $1 trillion in cross-border trade and investment per year and create greater economic opportunities for companies and citizens on both sides of the Atlantic. Lastly, Raimondo mentioned that, in the coming days, the U.S. Department of Commerce will launch a new website for the Data Privacy Framework Program, ahead of which guidance will be provided to participants to the EU-US Privacy Shield Framework to facilitate their transition to the DPF.

You can read the press release here.

Update: July 14, 2023

CNIL

On July 13, 2023, CNIL published a Q&A page on the EU-US DPF. Among other things, the Q&A page notes the key elements of the EU-US DPF, the consequences for organizations wishing to transfer data to the US, and the impact of the adequacy decision for organizations using other transfer mechanisms.

You can read the Q&A page, only available in French, here.

Update: July 18, 2023

Cyprus

On July 11, 2023, the Office of the Commissioner for Personal Data Protection (the Commissioner) issued a statement on the Commission's adequacy decision on the EU-US DPF. The Commissioner highlighted that the EU-US DPF will be subject to periodic reviews, which the Commissioner noted will be carried out within a year from the entry into force of the adequacy decision.

You can read the statement, only available in Greek, here.

Update: July 19, 2023

TLfDI

On July 14, 2023, the Thuringian data protection authority (TLfDI) issued a statement on the Commission's adequacy decision on the EU-US DPF. The TLfDI noted that, despite the Commission's adequacy decision on the EU-US DPF, the conclusion that Microsoft 365 is legally compliant to be used in Thuringian schools cannot be drawn. Further, the TLfDI added that, the persons responsible for using Microsoft 365 have an obligation to provide evidence that the same can be used transparently and lawfully in accordance with Article 5(2) of the General Data Protection Regulation (GDPR). According to the TLfDI, the above particularly applies to schools, because children's data requires more protection.

You can read the press release, only available in German, here.

Update: July 21, 2023

BBB National Programs

On July 11, 2023, BBB National Programs' Senior Vice President of Privacy Initiatives, Dona Fraser, issued a statement on the Commission's adequacy decision on the EU-US DPF. Fraser commended the White House, the U.S. Department of Commerce, and the Commission, for achieving the EU-US DPF adequacy decision. Additionally, Fraser noted that the EU-US DPF is a transformative milestone that can propel the transatlantic economy, present countless business opportunities, and foster trust in data security. Further, according to Fraser, the BBB National Programs is prepared to facilitate companies with a seamless transition to the EU-US DPF.

You can read the press release here.

Update: August 1, 2023

LfDI Baden-Württemberg

On July 28, 2023, the Baden-Württemberg data protection authority (LfDI Baden-Württemberg) issued a statement outlining the Commission's adequacy decision's impact on international data transfers.

You can read the statement, only available in German, here.

Update: August 11, 2023

BayLfD

On August 1, 2023, the Bavarian data protection authority (BayLfD) published a statement regarding the Commission's adequacy decision on the EU-US DPF, providing an overview of its key points, as well as explaining its impact on data transfers for the Bavarian public sector.

You can read the statement, only available in German, here.