# Standards and Regulatory References

## Primary Legal Instruments

### Commission Implementing Decision (EU) 2023/1795
- **Date of adoption**: 10 July 2023
- **Legal basis**: GDPR Art. 45(3)
- **Subject**: Adequate level of protection of personal data under the EU-US Data Privacy Framework
- **Structure**: Recitals (1)-(215) analysing the US legal framework; operative articles establishing the adequacy finding; annexes containing the DPF Principles and supplemental principles

### US Executive Order 14086
- **Title**: Enhancing Safeguards for United States Signals Intelligence Activities
- **Date**: 7 October 2022
- **Key provisions**: Establishes necessity and proportionality standards for signals intelligence, enumerates prohibited collection purposes, creates the DPRC redress mechanism, requires data retention limits
- **Binding nature**: Creates binding obligations on US intelligence community elements enforceable through the DPRC

### Attorney General Regulation — Data Protection Review Court
- **Date**: 29 June 2023
- **Establishes**: Two-tier review mechanism (CLPO + DPRC) for complaints from qualifying states regarding US signals intelligence activities
- **Court composition**: Judges appointed by the Attorney General with relevant experience; not current US government employees; security-cleared
- **Special advocate**: Appointed for each case to represent the complainant's interests

### FISA Section 702 (Foreign Intelligence Surveillance Act)
- **Current authorisation**: Reauthorised April 2024, effective through April 2026
- **Scope**: Authorises targeted surveillance of non-US persons located outside the United States to acquire foreign intelligence information
- **Relevance to DPF**: Central to Schrems II concerns; EO 14086 applies additional safeguards to Section 702 collection
- **Oversight**: Foreign Intelligence Surveillance Court (FISC) annual certification review

## GDPR Provisions

### Article 45 — Transfers on the Basis of an Adequacy Decision
- **Art. 45(1)**: Transfer may take place where the Commission has decided that the third country ensures an adequate level of protection.
- **Art. 45(2)**: Factors to consider include rule of law, human rights, data protection legislation, supervisory authorities, and international commitments.
- **Art. 45(3)**: Commission may adopt implementing acts declaring adequacy; periodic review at least every four years.
- **Art. 45(4)**: Commission shall monitor developments that could affect the adequacy finding.
- **Art. 45(5)**: Commission may repeal, amend, or suspend the adequacy decision.

### Article 46 — Transfers Subject to Appropriate Safeguards
- **Relevance**: Art. 46 mechanisms (SCCs, BCRs) serve as backup transfer instruments if the DPF adequacy decision is suspended or invalidated.

## Judicial Precedent

### Schrems I — CJEU Case C-362/14 (6 October 2015)
- Invalidated Commission Decision 2000/520/EC (Safe Harbour)
- Held that the Commission must assess whether a third country ensures a level of protection of fundamental rights essentially equivalent to that guaranteed in the EU legal order
- Established that SAs retain the power to examine whether a transfer complies with the GDPR even when an adequacy decision exists

### Schrems II — CJEU Case C-311/18 (16 July 2020)
- Invalidated Commission Implementing Decision (EU) 2016/1250 (Privacy Shield)
- Found that US surveillance programmes (Section 702 FISA, EO 12333) did not meet EU essential equivalence standard due to: lack of proportionality in bulk collection, absence of independent judicial oversight, and inadequate redress for EU data subjects
- DPF specifically designed to address these three deficiencies through EO 14086 and the DPRC

## Regulatory Guidance

### EDPB Information Note on the EU-US Data Privacy Framework (18 July 2023)
- Confirmed that transfers to DPF-certified US organisations may proceed without additional safeguards
- Reminded controllers of the obligation to verify the importer's active DPF certification
- Noted that the EDPB will participate in the periodic review process

### European Commission First Annual Review Report (October 2024)
- Concluded the DPF continues to provide adequate protection
- Assessed FTC enforcement actions against non-compliant organisations
- Reviewed the operationalisation of the DPRC
- Recommended continued monitoring of FISA Section 702 developments

### FTC Enforcement Policy Statement on DPF (July 2023)
- FTC committed to prioritising enforcement against DPF non-compliance
- False or deceptive DPF self-certification constitutes unfair or deceptive acts under Section 5 of the FTC Act
- FTC can impose civil penalties, injunctive relief, and compliance monitoring

## Enforcement Precedents

### FTC v. CafePress (2022)
- Action against former Privacy Shield participant for deceptive privacy practices
- USD 500,000 penalty and comprehensive compliance order
- Demonstrated FTC willingness to enforce data protection commitments

### FTC v. Residual Pumpkin Entity (dba CafePress) — Privacy Shield (2023)
- Follow-up enforcement confirming that Privacy Shield/DPF certification obligations survive corporate transactions
- Required the acquiring company to maintain compliance programmes

### FTC Referrals to DoC (2024)
- 12 organisations referred to the DoC for failure to complete annual re-certification
- Organisations removed from the DPF List and required to continue applying DPF protections to previously transferred data