European Commission Adopts EU-U.S. Data Privacy Framework

Significant development that brings relief to users of Google Analytics 4 (GA4) and Google Tag Manager (GTM), the European Commission has adopted the EU-U.S. Data Privacy Framework.

This framework concludes that the United States ensures a level of data protection that is comparable to that of the European Union, allowing for the transfer of personal data from the EU to US companies under the new regulations. This means that data can flow securely from the EU to US companies participating in the Framework, such as GA4 and GTM, without the need for additional data protection safeguards.

This Framework introduces significant improvements compared to the Privacy Shield, easing the concerns of GA4 and GTM users. US companies will have to commit to complying with privacy obligations like deleting personal data when no longer necessary for the purpose collected and ensuring continuity of protection when personal data is shared with third parties.

EU individuals will benefit from several redress avenues in case their data is mishandled by US companies, including free dispute resolution mechanisms and an arbitration panel. Additionally, the US legal framework provides safeguards regarding access to data transferred under the framework by US public authorities for criminal law enforcement and national security purposes. Access to data is limited to what is necessary and proportionate to protect national security.

Notably, the safeguards put in place by the US will facilitate transatlantic data flows more generally, since they apply when data is transferred using other tools, like standard contractual clauses and binding corporate rules. This widens the spectrum of secure data operations for GA4 and GTM users.

The functioning of the EU-U.S. Data Privacy Framework will be subject to periodic reviews. The first review will occur within a year of the entry into force of the adequacy decision, verifying that all relevant elements have been fully implemented in the US legal framework and are functioning effectively in practice.”