{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2023/1795 — Decision — Adequate protection under the EU-US Data Privacy Framework [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/annexes/annex-vi","url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/annexes/annex-vi","title":"ANNEX VI","family":"l2_unit_view","work_id":"spaces/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework","view_of":"/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Commission Implementing Decision (EU) 2023/1795, OJ L 231, 20.9.2023","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng","valid_from":"2023-07-10","valid_until":null,"content_id":"bd4866d73fb05d1e","versions":["2023-07-10"],"version_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/annexes/annex-vi/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/annexes/annex-vi/versions/2026-10-26/rev/bd4866d73fb05d1e","versions_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/annexes/annex-vi/versions","relations_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/annexes/annex-vi/relations","act_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework#annex-vi","source_line":"Commission Implementing Decision (EU) 2023/1795 · binding on its addressees · dated 10 Jul 2023 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"implementing_decision","legal_nature":"binding_adopted","addressees":["the Member States"],"dates":{"document_date":"2023-07-10","entry_into_force":"2023-07-10","locators":{"document_date":"CELLAR 32023D1795 work_date_document","entry_into_force":"CELLAR 32023D1795 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework","path":"/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework","name":"Commission Implementing Decision (EU) 2023/1795","number":"2016/679","celex":"32023D1795","title_official":"COMMISSION IMPLEMENTING DECISION EU 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework (notified under document C(2023)4745) (Text with EEA relevance)","document_date":"2023-07-10"},"position":{"kind":"annex","key":"annex-vi","index":6,"articles":4,"annexes":8},"prev":{"path":"/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/annexes/annex-v","key":"annex-v","title":"ANNEX V"},"next":{"path":"/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/annexes/annex-vii","key":"annex-vii","title":"ANNEX VII"},"act_anchor":"#annex-vi"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework.md","unit_text_sha256":"fee5c7fb2fae1ddfdc8c862636206420762275e58d37fc9148b69eab58179ff6","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/annex-vi","kind":"annex","key":"annex-vi","heading":"ANNEX VI","text":"## ANNEX VI\n\n\n\n\n
\n\n
U.S. Department of Justice
Criminal Division
\n
Office of Assistant Attorney General
Washington, D.C. 20530
\n\n
\n\n\nJune 23, 2023\n\nMs. Ana Gallego Torres\n\nDirector-General for Justice and Consumers\n\nEuropean Commission\n\nRue Montoyer/Montoyerstraat 59\n\n1049 Brussels\n\nBelgium\n\nDear Ms. Director-General Gallego Torres:\n\nThis letter provides a brief overview of the primary investigative tools used to obtain commercial data and other record information from corporations in the United States for criminal law enforcement or public interest (civil and regulatory) purposes, including the access limitations set forth in those authorities. All the legal processes described in this letter are nondiscriminatory in that they are used to obtain information from corporations in the United States, including from companies that will self-certify through the EU-U.S. Data Privacy Framework, without regard to the nationality or place of residence of the data subject. Further, corporations that receive legal process in the United States may challenge it in court as discussed below.\n\nOf particular note with respect to the seizure of data by public authorities is the Fourth Amendment to the United States Constitution, which provides that \"\\[t\\]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.\" U.S. Const. amend. IV. As the United States Supreme Court stated in Berger v. State of New York, \"\\[t\\]he basic purpose of this Amendment, as recognized in countless decisions of this Court, is to safeguard the privacy and security of individuals against arbitrary invasions by governmental officials.\" 388 U.S. 41, 53 (1967) (citing Camara v. Mun. Court of San Francisco, 387 U.S. 523, 528 (1967)). In domestic criminal investigations, the Fourth Amendment generally requires law enforcement officers to obtain a court-issued warrant before conducting a search. See Katz v. United States, 389 U.S. 347, 357 (1967). Standards for the issuance of a warrant, such as the probable cause and particularity requirements, apply to warrants for physical searches and seizures as well as to warrants for the stored content of electronic communications issued under the Stored Communications Act as discussed below. When the warrant requirement does not apply, government activity is still subject to a \"reasonableness\" test under the Fourth Amendment. The Constitution itself, therefore, ensures that the U.S. government does not have limitless, or arbitrary, power to seize private information.\n\nCriminal Law Enforcement Authorities:\n\nFederal prosecutors, who are officials of the Department of Justice (DOJ), and federal investigative agents including agents of the Federal Bureau of Investigation (FBI), a law enforcement agency within DOJ, are able to compel production of documents and other record information from corporations in the United States for criminal investigative purposes through several types of compulsory legal processes, including grand jury subpoenas, administrative subpoenas, and search warrants, and may acquire other communications pursuant to federal criminal wiretap and pen register authorities.\n\nGrand Jury or Trial Subpoenas: Criminal subpoenas are used to support targeted law enforcement investigations. A grand jury subpoena is an official request issued from a grand jury (usually at the request of a federal prosecutor) to support a grand jury investigation into a particular suspected violation of criminal law. Grand juries are an investigative aim of the court and are empaneled by a judge or magistrate. A subpoena may require someone to testify at a proceeding, or to produce or make available business records, electronically stored information, or other tangible items. The information must be relevant to the investigation and the subpoena cannot be unreasonable because it is overbroad, or because it is oppressive or burdensome. A recipient can file a motion to challenge a subpoena based on those grounds. See Fed. R. Crim. P. 17. In limited circumstances, trial subpoenas for documents may be used after the case has been indicted by the grand jury.\n\nAdministrative Subpoena Authority: Administrative subpoena authorities may be exercised in criminal or civil investigations. In the criminal law enforcement context, several federal statutes authorize the use of administrative subpoenas to produce or make available business records, electronically stored information, or other tangible items relevant to investigations involving health care fraud, child abuse, Secret Service protection, controlled substance cases, and Inspector General investigations implicating government agencies. If the government seeks to enforce an administrative subpoena in court, the recipient of the administrative subpoena, like the recipient of a grand jury subpoena, can argue that the subpoena is unreasonable because it is overbroad, or because it is oppressive or burdensome.\n\nCourt Orders For Pen Register and Trap and Traces: Under criminal pen register and trap-and-trace provisions, law enforcement may obtain a court order to acquire real-time, non- content dialing, routing, addressing, and signaling information about a phone number or email upon certification that the information provided is relevant to a pending criminal investigation. See 18 U.S.C. §§ 3121-3127. The use or installation of such a device outside the law is a federal crime.\n\nElectronic Communications Privacy Act (ECPA): Additional rules govern the government's access to subscriber information, traffic data, and stored content of communications held by internet service providers (also known as \"ISPs\"), telephone companies, and other third-party service providers, pursuant to Title II of ECPA, also called the Stored Communications Act (SCA), 18 U.S.C. §§ 2701-2712. The SCA sets forth a system of statutory privacy rights that limit law enforcement access to data beyond what is required under Constitutional law from customers and subscribers of ISPs. The SCA provides for increasing levels of privacy protections depending on the intrusiveness of the collection. For subscriber registration information, Internet Protocol (IP) addresses and associated time stamps, fil\\\\d billing information, criminal law enforcement authorities must obtain a subpoena. For most other stored, non-content information, such as email he11-ders without the subject line, law enforcement must present specific facts to a judge demonstrating that the requested information is relevant and material to an ongoing criminal investigation. To obtain the stored content of electronic communications, generally, criminal law enforcement authorities must obtain a warrant from a judge based on probable cause to believe the account in question contains evidence of a crime. The SCA also provides for civil liability and criminal penalties.\n\nCourt Orders for Surveillance Pursuant to Federal Wiretap Law: Additionally, law enforcement may intercept in real time wire, oral, or electronic communications for criminal investigative purposes pursuant to the federal wiretap law. See 18 U.S.C. §§ 2510-2523. This authority is available only pursuant to a court order in which a judge finds, inter alia, that there is probable cause to believe that the wiretap or electronic interception will produce evidence of a federal crime, or the whereabouts of a fugitive fleeing from prosecution. The statute provides for civil liability and criminal penalties for violations of the wiretapping provisions.\n\nSearch Warrant-Fed. R. Crim. P. Rule 41: Law enforcement can physically search premises in the United States when authorized to do so by a judge. Law enforcement must demonstrate to the judge based on a showing of probable cause that a crime was committed or is about to be committed and that items connected to the crime are likely to be found in the place specified by the warrant. This authority is often used when a physical search by police of a premise is needed due to the danger that evidence may be destroyed if a subpoena or other production order is served on the corporation. A person subject to a search or whose property is· subject to a search may move to suppress evidence obtained or derived from an unlawful search if that evidence is introduced against that person during a criminal trial. See Mapp v. Ohio, 367 U.S. 643 (1961). When a data holder is required to disclose data pursuant to a warrant, the compelled party may challenge the requirement to disclose as unduly burdensome. See In re Application of United States, 610 F.2d 1148, 1157 (3d Cir. 1979) (holding that \"due process requires a hearing on the issue of burdensomeness before compelling a telephone company to provide\" assistance with a search warrant); In re Application of United States, 616 F.2d 1122 (9th Cir. 1980) (reaching same conclusion based on court's supervisory authority).\n\nDOJ Guidelines and Policies: In addition to these Constitutional, statutory, and rule- based limitations on government access to data, the Attorney General has issued guidelines that place further limits on law enforcement access to data, and that also contain privacy and civil liberties protections. For instance, the Attorney General's Guidelines for Domestic FBI Operations (September 2008) (hereinafter AG FBI Guidelines), available at http://www.justice.gov/archive/opa/docs/guidelines.pdf, set limits on use of investigative means to seek information related to investigations that involve federal crimes. These guidelines require that the FBI use the least intrusive investigative methods feasible, taking into account the effect on privacy and civil liberties and the potential damage to reputation. Further, they note that \"it is axiomatic that the FBI must conduct its investigations and other activities in a lawful and reasonable manner that respects liberty and privacy and avoids unnecessary intrusions into . the lives of law-abiding people.\" AG FBI Guidelines at 5. The FBI has implemented these guidelines through the FBI Domestic Investigations and Operations Guide (DIOG), available at https://vault.fbi.gov/FBI%20Domestic%20Investigations%20and%20Operations%20Guide%20%28DIOG%29 , a comprehensive manual that includes detailed limits on use of investigative tools and guidance to assure that civil liberties and privacy are protected in every investigation. Additional rules and policies that prescribe limitations on the investigative activities of federal prosecutors are set out in the Justice Manual, also available online at https://www.justice.gov/jm/justicemanual.\n\nCivil and Regulatory Authorities (Public Interest):\n\nThere are also significant limits on civil or regulatory (i.e., \"public interest\") access to data held by corporations in the United States. Agencies with civil and regulatory responsibilities may issue subpoenas to corporations for business records, electronically stored information, or other tangible items. These agencies are limited in their exercise of administrative or civil subpoena authority not only by their organic statutes, but also by independent judicial review of subpoenas prior to potential judicial enforcement. See, e.g., Fed. R. Civ. P. 45. Agencies may seek access only to data that is relevant to matters within their scope of authority to regulate. Further, a recipient of an administrative subpoena may challenge the enforcement of that subpoena in court by presenting evidence that the agency has not acted in accordance with basic standards of reasonableness, as discussed earlier.\n\nThere are other legal bases for companies to challenge data requests from administrative agencies based on their specific industries and the types of data they possess. For example, financial institutions can challenge administrative subpoenas seeking certain types of information as violations of the Bank Secrecy Act and its implementing regulations. 31 U.S.C. § 5318; 31 C.F.R. Chapter X. Other businesses can rely on the Fair Credit Reporting Act, 15 U.S.C. § 1681b, or a host of other sector specific laws. Misuse of an agency's subpoena authority can result in agency liability, or personal liability for agency officers. See, e.g., Right to Financial Privacy Act, 12 U.S.C. §§ 3401-3423. Courts in the United States thus stand as the guardians against improper regulatory requests and provide independent oversight of federal agency actions.\n\nFinally, any statutory power that administrative authorities have to physically seize records from a company in the United States pursuant to an administrative search must meet requirements based on the Fourth Amendment. See See v. City of Seattle, 387 U.S. 541 (1967).\n\nConclusion:\n\nAll law enforcement and regulatory activities in the United States must conform to applicable law, including the U.S. Constitution, statutes, rules, and regulations. Such activities must also comply with applicable policies, including any Attorney General Guidelines governing federal law enforcement activities. The legal framework described above limits the ability of U.S. law enforcement and regulatory agencies to acquire information from corporations in the United States-whether the information concerns U.S. persons or citizens of foreign countries-and in addition permits judicial review of any government requests for data pursuant to these authorities.\n\n\n\n","marks":[],"text_hash":"fee5c7fb2fae1ddfdc8c862636206420762275e58d37fc9148b69eab58179ff6","revision":1}}
![\"Figure](\"../../.gitbook/assets/gdpr-l2-32023D1795-t04-image-1.jpg\")