United Kingdom: Drafted Data Protection (Adequacy) (United States of America) Regulations 2023

On 20 September 2023, the Department for Science, Innovation and Technology of the United Kingdom drafted the Data Protection (Adequacy) (United States of America) Regulations 2023. The regulations, issued under the authority of the Data Protection Act 2018, declare that the United States of America provides an adequate level of personal data protection for specific transfers. In addition, the regulations state that when personal data is transferred to entities in the United States of America that are part of the UK Extension to the EU-US Data Privacy Framework and follow the EU-US Data Privacy Framework Principles, additional approval is not needed. The United States Federal Trade Commission and the United States Department of Transportation have been assigned as the independent supervisory authorities for the UK Extension to the EU-US Data Privacy Framework. Moreover, an impact assessment will be published alongside the explanatory memorandum to assess how these regulations will affect businesses, the voluntary sector, and the public sector. The regulations will be presented to the parliament on 21 September 2023 and come into force on 12 October 2023.