Germany: Issued DSK application notes on the adequacy decision on the EU-US Data Privacy Framework

On 28 February 2024, the Baden-Württemberg State Commissioner for Data Protection and Freedom of Information issued its application notes on the adequacy decision on the EU-US Data Privacy Framework. The notes explain the scope of the EU-US Data Privacy Framework and its applicability to data transfers from Baden-Württemberg to the USA, and they discuss alternative data transfer mechanisms that can be used in the absence of an adequacy decision, such as Standard Data Protection Clauses (SCCs) and Binding Corporate Rules (BCRs). In addition, they explain the rights of individuals whose personal data is transferred to the USA, including the right to access, rectify, and erase their data. The application notes stress the need for a thorough assessment of the US legal framework and practices when using mechanisms like SCCs for data transfers to the USA. This assessment is called a Transfer Impact Assessment (TIA) and should take into account factors such as the nature of the data, the purposes of the transfer, and the recipient's data protection practices.