Home > Security and Compliance Blog > Regulatory Compliance > New EU-U.S. Data Privacy Framework: A Comprehensive Breakdown and What it Means for Your Business

New EU-U.S. Data Privacy Framework: A Comprehensive Breakdown and What it Means for Your Business

by Danielle Barbour updated July 11, 2023 Regulatory Compliance

Reading Time: 6 minutes

The European Commission recently adopted its adequacy decision for the EU-U.S. Data Privacy Framework, marking a pivotal milestone in global data privacy. The decision concludes that the United States must ensure a level of protection for personal data transferred from the EU to U.S. companies that is comparable to the EU.

This new framework introduces a host of improved safeguards, promising to alter the data privacy landscape for organizations conducting business across the Atlantic. For organizations looking to navigate these changes, service providers like Kiteworks are poised to simplify and speed up achieving compliance with this new framework.

A New Era in Data Privacy

The framework’s inception comes because of an adequacy decision undertaken by the European Commission. This decision acknowledges that the United States provides an adequate level of protection for personal data transferred from the EU to the U.S., mirroring the safeguards provided by the EU. The decision permits free and safe flow of data from entities within the European Economic Area (EEA) to participating U.S. companies under the EU-U.S. Data Privacy Framework. The EEA includes the 27 EU Member States as well as Norway, Iceland, and Liechtenstein.

This decision came about in the wake of the U.S. signing an Executive Order on “Enhancing Safeguards for United States Signals Intelligence Activities,” which introduced new obligations to address concerns raised by the Court of Justice of the European Union in its Schrems II decision of July 2020.

A Look Into the Schrems II Decision

The Schrems II decision raised key issues regarding the extent to which US intelligence agencies could access data, and the need for a more impartial and independent mechanism to resolve complaints related to data collection for national security purposes. The new measures ensure that data can be accessed by U.S. intelligence agencies only to a degree necessary and proportionate. It also establishes a robust system for addressing grievances.

Understanding Adequacy Decisions

An adequacy decision is a mechanism provided under the General Data Protection Regulation (GDPR) that allows the transfer of personal data from the EU to third countries. These countries, in the Commission’s evaluation, must offer a comparable level of data protection to that within the EU.

Adequacy Assessment Criteria

Adequacy doesn’t imply that the third country’s data protection system is identical to that of the EU, but rather based on an “essential equivalence” standard. This involves an exhaustive evaluation of the country’s data protection framework, the protection applicable to personal data, and available oversight and redress mechanisms.

Elements such as the existence of core data protection principles, individual rights, independent supervision, and effective remedies are all considered for this assessment.

Compliance and Certification Table

Kiteworks touts a long list of compliance and certification achievements.

An Insight Into the EU-U.S. Data Privacy Framework

Under the adequacy decision, the Commission has meticulously evaluated the EU-U.S. Data Privacy Framework requirements, limitations, and safeguards applicable when personal data transferred to the U.S. would be accessed by U.S. public authorities for criminal law enforcement and national security purposes.

Benefits of the Framework

The framework provides several new rights to EU individuals whose data would be transferred to participating U.S. companies, including access to their data and correction or deletion of incorrect or unlawfully handled data. It also offers multiple redress avenues for wrongly handled data, including independent dispute resolution mechanisms and an arbitration panel.

U.S. companies can certify their commitment to the EU-U.S. Data Privacy Framework by adhering to a detailed set of privacy obligations, such as purpose limitation, data minimization, and data retention, as well as specific responsibilities related to data security and data sharing with third parties.

Administration and Enforcement of the Framework

The U.S. Department of Commerce will administer the framework, processing applications for certification, and monitoring if participating companies continuously meet the certification requirements. Compliance will be enforced by the U.S. Federal Trade Commission.

Limitations and Safeguards of Data Access by U.S. Intelligence Agencies

The Executive Order on “Enhancing Safeguards for United States Signals Intelligence Activities” forms a key element of the U.S. legal framework that supports the adequacy decision. This order provides several safeguards for Europeans whose personal data is transferred to the U.S., including limiting access to data by U.S. intelligence authorities, enhancing oversight of intelligence services’ activities, and establishing an independent redress mechanism.

The Redress Mechanism for National Security Issues

The U.S. government has established a new two-layer redress mechanism with independent and binding authority to handle complaints from individuals whose data has been transferred from the EEA to US companies concerning data collection and use by U.S. intelligence agencies.

The Complaint Process

The complaint process begins with the Civil Liberties Protection Officer of the U.S. intelligence community, and individuals can appeal the officer’s decision before the newly created Data Protection Review Court (DPRC). The Court is composed of members from outside the U.S. government, who cannot receive instructions from the government and have powers to investigate complaints and take binding remedial decisions.

Implementation Timeline

The adequacy decision took effect immediately upon its adoption on July 10, 2023. Although there’s no specific timeline, the Commission will continually monitor relevant developments in the U.S. and regularly review the adequacy decision, starting one year after the decision came into force.

Impact on Other Data Transfer Tools

The safeguards established by the U.S. government in national security apply to all data transfers under the GDPR to companies in the U.S., regardless of the transfer mechanisms used. These safeguards, therefore, also facilitate the use of other tools, such as standard contractual clauses and binding corporate rules.

Use Kiteworks to Accelerate Compliance With the EU-U.S. Data Privacy Framework

The Kiteworks Private Content Network (PCN) empowers organizations to safeguard sensitive information with every send, share, receive, and save, thereby facilitating seamless interactions with customers and trading partners worldwide. A significant portion of Kiteworks’ client base utilizes the platform to ensure compliance with a range of privacy regulations, including GDPR, numerous state data privacy regulations, such as the California Consumer Privacy Act (CCPA) and numerous other U.S. state laws that have been passed, the Personal Data Protection Act (PDPA), the Personal Information Protection and Electronic Documents Act (PIPEDA), the Health Insurance Portability and Accountability Act (HIPAA), and others.

While the newly established EU-U.S. Data Privacy Framework seeks to minimize the risk of EU citizens’ sensitive data falling into the hands of U.S. government agencies, like law enforcement or the NSA, it doesn’t eliminate the possibility entirely. This is where Kiteworks steps in, offering an additional layer of data protection and control.

At the heart of Kiteworks’ privacy protection strategy is the absolute control it provides over content. Using a digital rights management approach, organizations can define exactly where their data is geographically stored, who can access it, and when it expires. This comprehensive control extends to audit logs, offering a transparent, verifiable record of data-handling activities. This transparency ensures organizations can effectively demonstrate compliance with the new EU-U.S. framework and other regulations. Importantly, Kiteworks maintains a strict policy that prevents its employees from accessing customer content, eliminating the potential of any unauthorized data disclosure.

When it comes to handling sensitive data belonging to external parties, Kiteworks offers sophisticated tools to meet the needs of privacy regulation compliance. Organizations can set automated expiration policies aligned with their specific requirements. This ensures that data is not retained longer than necessary, reducing the risk of unauthorized access or breaches.

Further, Kiteworks facilitates compliance with data subject rights, including the right to erasure under the GDPR and the new redress mechanism under the EU-U.S. framework. Organizations can swiftly search for, locate, and erase data upon customer request, ensuring compliance with these crucial aspects of data privacy regulations.

Finally, Kiteworks employs a hardened virtual appliance that applies layers of security, embeds a network firewall and web application firewall (WAF), employs end-to-end encryption, integrates advanced security technology such as content disarm and reconstruction (CDR), data loss prevention (DLP), and advanced threat response (ATR), and utilizes AI-enabled anomaly detection. This makes it immensely more difficult for rogue nation-states and cybercriminals to exploit sensitive content communications, ensuring private data of EU citizens is protected.

With Kiteworks, organizations have comprehensive and flexible capabilities that they can tap to navigate the complex terrain of global data privacy regulations, including the newly adopted EU-U.S. Data Privacy Framework. By providing unparalleled data control, maintaining data residency, offering comprehensive audit logs, and facilitating data access requests, Kiteworks ensures that organizations can readily demonstrate adherence to the new EU-U.S. Data Privacy Framework, as well as other data privacy regulations.

Schedule a custom demo of Kiteworks today to see how it can accelerate your compliance with the EU-U.S. Data Privacy Framework.

Additional Resources