{"id":305538,"date":"2025-04-23T16:08:30","date_gmt":"2025-04-23T14:08:30","guid":{"rendered":"https:\/\/nextcloud.com\/?p=305538"},"modified":"2026-03-03T15:45:36","modified_gmt":"2026-03-03T14:45:36","slug":"eu-us-data-privacy-framework-is-defunct-what-does-this-mean-for-businesses","status":"publish","type":"post","link":"https:\/\/nextcloud.com\/es\/blog\/eu-us-data-privacy-framework-is-defunct-what-does-this-mean-for-businesses\/","title":{"rendered":"EU-US Data Privacy Framework is defunct: what does this mean for businesses?"},"content":{"rendered":"\n
\"EU-US<\/figure>\n\n\n\n
<\/div>\n\n\n\n

For years, the question of whether storing personal data in US-based cloud services complies with European privacy laws has been a legal and political minefield. While the EU and US have repeatedly attempted to establish frameworks to enable transatlantic data flows, these agreements have consistently failed to withstand legal scrutiny. <\/p>\n\n\n\n

The latest iteration of those attempts, the EU-US Data Privacy Framework (DPF)<\/a>, is now facing the same fate as its predecessors \u2014 rendered practically defunct due to structural issues and alarming developments in US oversight mechanisms. <\/p>\n\n\n\n

If the deal is revoked, this could turn disastrous<\/a> for companies. Judges in the EU could make the use of US clouds illegal at any moment. Read on to understand what the current situation around the agreement could mean for businesses handling data across the continents.<\/p>\n\n\n\n

Oversight’s board chair and members laid off<\/h2>\n\n\n\n

A key provision in the DPF is the oversight function provided by the US Privacy and Civil Liberties Oversight Board (PCLOB). However, on January 27, the chairman of the board and two other members were dismissed, leaving only one active board member and a skeleton legal team of four staff members<\/a>. Judge found the dismissal of the two members of the board unlawful<\/a>.<\/p>\n\n\n\n

With such a weakened oversight body, the fundamental concerns that led the Court of Justice of the European Union (CJEU) to strike down previous agreements remain unaddressed. The current DPF is unlikely to survive<\/a> the inevitable legal challenges ahead, much like its predecessors, Privacy Shield and Safe Harbor.<\/p>\n\n\n\n

The legal reality: data transfers to the US remain risky<\/h2>\n\n\n\n

From a legal perspective, the CJEU\u2019s rulings on transatlantic data transfers have been clear: unless the US implements substantial legal reforms, no framework will provide sufficient protection under EU law. The General Data Protection Regulation (GDPR) requires that personal data be protected with a level of security equivalent to what is granted within the EU. However, under US law, foreign citizens lack the same privacy rights as US residents, and intelligence agencies retain broad access to data stored by US-based companies.<\/p>\n\n\n\n

This means that, despite the existence of the DPF, organizations handling EU personal data must assess whether their transfers to US-based cloud providers comply with GDPR. In practice, this is difficult, if not impossible, without additional safeguards such as encryption, data localization, or alternative hosting solutions.<\/p>\n\n\n\n

EU-US Data Privacy Framework at risk: what this means for businesses<\/h2>\n\n\n\n

Companies relying on US cloud providers to store or process EU customer data are left in an uncertain position. Even if they adhere to the DPF, they may still be violating GDPR due to the unresolved structural issues. Legal challenges are inevitable, and it is only a matter of time before the CJEU is asked to review the framework once again.<\/p>\n\n\n\n

For businesses, this could mean several things:<\/p>\n\n\n\n