BRUSSELS — BSA | The Software Alliance welcomes the European Commission’s publication of its first review report of the EU-US Data Privacy Framework (DPF) and is pleased to see it confirming that the US authorities have successfully put in place all the necessary elements required to support the framework’s data protection standards, ensuring continuity and seamless data transfers across the Atlantic.

 The report specifically highlights these measures, including the implementation of critical safeguards to ensure that national security authorities’ access to personal data is limited to what is strictly necessary and proportionate. BSA believes this step marks a crucial milestone in building trust and transparency in transatlantic data flows. 

"We’re delighted to see that the US has delivered on its commitment to create a solid foundation for the DPF," Aaron Cooper, Senior Vice President, Global Policy at BSA said. "The establishment of an independent redress mechanism adds another layer of accountability, giving individuals the confidence that their privacy rights will be protected." 

However, the report’s conclusion also identifies a few areas that require continued attention to ensure the DPF’s stability. Notably, it calls for the US Department of Commerce, FTC, and EU Data Protection Authorities to develop unified guidance on the DPF's "key requirements," specifically regarding human resources data and onward transfers. 

"This recommendation highlights the importance of ongoing collaboration to ensure the framework remains robust," remarked Thomas Boué, BSA’s Director General – Policy EMEA. "As we move forward, all stakeholders must keep up the momentum to strengthen the framework’s implementation. Data flows between the EU and the US are the lifeblood of innovation and economic growth, and we will continue to ensure that they operate under the highest standards of privacy protection.” 

BSA strongly supports Transatlantic data flows, which remain significant to both Europe and the US, representing over half of Europe’s data transfers and nearly as much for the US. For businesses of all sizes, these seamless data exchanges are essential—they facilitate reaching customers, managing supply chains, driving research, and enhancing service delivery. Equally important is the need to assure citizens on both sides that their personal data is handled with the utmost privacy and security during these transfers. To this end, BSA and its Global Data Alliance have been steadfast advocates of the EU-US DPF, actively guiding our members on its principles and compliance requirements. Earlier this year, we endorsed the review process, recognizing its significance in supporting secure and transparent data flows between the EU and the US.