ANNEX IISupplementary provisions
ANNEX II UNITED STATES DEPARTMENT OF COMMERCE Secretary of Commerce Washington, D.C. 20230 July 6, 2023 The Honorable Didier Reynders Commissioner for Justice European Commission Rue de la Loi/ Westraat 200 1049 Brussels Belgium Dear Commissioner Reynders: On behalf of the United States, I am pleased to transmit herewith a package of EU-U.S. Data Privacy Framework materials that, combined with Executive Order 14086, “Enhancing Safeguards for United States Signals Intelligence Activities” and 28 CFR part 201 amending Department of Justice regulations to establish the “Data Protection Review Court”, reflects important and detailed negotiations to strengthen privacy and civil liberties protections. These negotiations have resulted in new safeguards to ensure that U.S. signals intelligence activities are necessary and proportionate in the pursuit of defined national security objectives and a new mechanism for European Union (“EU”) individuals to seek redress if they believe they are unlawfully targeted by signals intelligence activities, which together will ensure the privacy of EU personal data. The EU-U.S. Data Privacy Framework will underpin an inclusive and competitive digital economy. We should both be proud of the improvements reflected in that Framework, which will enhance the protection of privacy around the world. This package, along with the Executive Order, Regulations, and other materials available from public sources, provides a very strong basis for a new adequacy finding by the European Commission. ( 1 ) The following materials are attached: — The EU-U.S. Data Privacy Framework Principles, including the Supplemental Principles (collectively “the Principles”) and Annex I of the Principles ( i.e. , an annex providing the terms under which Data Privacy Framework organizations are obligated to arbitrate certain residual claims as to personal data covered by the Principles); — A letter from the Department’s International Trade Administration, which administers the Data Privacy Framework program, describing the commitments that our Department has made to ensure that the EU-U.S. Data Privacy Framework operates effectively; — A letter from the Federal Trade Commission describing its enforcement of the Principles; — A letter from the Department of Transportation describing its enforcement of the Principles; — A letter prepared by the Office of the Director of National Intelligence regarding safeguards and limitations applicable to U.S. national security authorities; and — A letter prepared by the Department of Justice regarding safeguards and limitations on U.S. Government access for law enforcement and public interest purposes. The full EU-U.S. Data Privacy Framework Package will be published on the Department’s Data Privacy Framework website and the Principles and Annex I of the Principles will be effective on the date of entry into force of the European Commission’s adequacy decision. You can be assured that the United States takes these commitments seriously. We look forward to working with you as the EU-U.S. Data Privacy Framework is implemented and as we embark on the next phase of this process together. Sincerely, Gina M. RAIMONDO ( 1 ) Provided that the Commission Decision on the adequacy of the protection provided by the EU-U.S. Data Privacy Framework applies to Iceland, Liechtenstein and Norway, the EU-U.S. Data Privacy Framework Package will cover both the European Union, as well as these three countries.