DATA PROTECTION | EDPB releases FAQs on the EU-U.S. Data Privacy Framework

On 16 July 2024, the European Data Protection Board (EDPB) released new FAQs for businesses on the EU-US Data Privacy Framework (DPF), the self-certification mechanism that regulates international personal data transfers to the United States. EU companies that intend to rely on the DPF transfer mechanism must ensure that the US receiving company holds an active self-certification covering the data in question. However, not all US companies are eligible for this mechanism. Only those under the investigatory and enforcement jurisdiction of the US Federal Trade Commission (FTC) or the US Department of Commerce (DoC) qualify. This means entities like non-profits, banks, insurance companies, and telecom providers cannot self-certify under the DPF. The FAQs also clarify that an up-to-date list of self-certified companies is maintained by the DoC. Importantly, the FAQs stress that when a US data importer acts as a data processor, even if the company is self-certified, the EU data controller remains responsible for establishing a data processing agreement, as required by Article 28 of the GDPR.

Newsletter n. 99 – August/September 2024