Draft adequacy decision has been published

The EU Commission has published the long-awaited draft adequacy decision for data transfers from the EU to the US after analyzing US law and practice, including Executive Order 14086 and the AG Regulation. It concludes that the United States provides an adequate level of protection for personal data transferred in accordance with the EU-US Privacy Shield Framework. The EU-U.S. Privacy Shield Framework is a certification scheme under which U.S. organizations agree to comply with a set of privacy principles issued by the U.S. Department of Commerce. The principles apply immediately after the Certification. They do not affect the requirements of Regulation (EU) 2016/679 that apply to entities in the Union that transfer data, such as Earmarking, Data minimization, Transparency and Data security.

Personal data können im Rahmen der EU-US-GDPR von der EU in die USA übermittelt werden, mit Ausnahme von Daten, die für die Veröffentlichung, Ausstrahlung oder andere Formen der öffentlichen Kommunikation von journalistischem Material erhoben wurden. Die EU-US-Datenverarbeitungsgrundsätze gelten für Organisationen in den USA, die als für die Processing Responsible persons or processors and are contractually obliged to act only on the instructions of the person responsible for the Processing The EU-U.S. Privacy Shield Framework requires data controllers in the EU to act as data processors and assist them in responding to requests from individuals exercising their rights under the Principles. Under the EU-US Privacy Shield Framework personal data be processed lawfully and fairly and must not be incompatible with the purpose for which they were originally collected.

Under certain circumstances, the Processing sensitive data are not obtained. In accordance with the principle of data integrity and Earmarking However, organizations must ensure that personal data are correct, complete and up to date, and may personal data only for as long as it serves the purpose(s) for which it was originally collected or for which the data was collected. affected person has given their consent in accordance with the principle of freedom of choice. In addition personal data processed in a manner that ensures its security, including protection against unauthorized or unlawful processing. Processing and against accidental loss, destruction or damage. Finally, the data required for the Processing The data controller and the data processor must Technical and organizational measures seize.