On September 4, 2023, the Thuringian data protection authority (TLfDI) published its opinion on the German Data Protection Conference's (DSK) application instructions on the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF). In particular, the TLfDI did not agree with the DSK's position and suggested two points for consideration for the application instructions.

Firstly, the TLfDI stated that US providers/contractors are often not responsible parties within the meaning of the General Data Protection Regulation (GDPR). Therefore, according to the TLfDI, the notes for data exporters in Chapter II of the application instructions must be understood to mean that, due to the lack of regulations in the EU-US DPF regarding data protection obligations, the data controller must be able to fulfill the obligations without the help of the data exporter, or must ensure the obligations via processing agreements with the data importer. Additionally, the TLfDI stated that the data controller could rely on contractual assurances from the data importer, which the data importer should evidence. 

Secondly, the TLfDI highlighted certain criticisms of the EU-US DPF raised by the European Data Protection Board (EDPB) and Max Schrems and stated that the data exporters who wanted to rely on the EU-US DPF should be aware of the criticisms. According to TLfDI Commissioner, Dr. Lutz Hasse, ''companies should consider whether they should transfer sensitive data, including customer data, to the US or not as a precautionary measure until the European Court of Justice (CJEU) has decided. Because the probability that the CJEU will overturn the adequacy decision is then quite high.''

You can read the press release, only available in German, here.