GDPR UPDATE: PERSONAL DATA TRANSFER
29.09.2020
Recently there was a decision in the Court of Justice of the European Union in Case C-311/18 – Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems.
The CJEU has confirmed how EU standards of data protection must travel with the data when it goes overseas, which means this judgment has wider implications than just the invalidation of the EU-US Privacy Shield. It is a judgment that confirms the importance of safeguards for personal data transferred out of the UK.
First of all, I would like to explain what did the Court rule in its judgement. In the case of Data protection commissioner v Facebook Ireland Ltd and Maximilian Schrems, the Court examined the validity of the European Commission’s Decision 2010/87/EC on Standard Contractual Clauses (“SCCs”) and considered that it is valid.
However, that validity, the Court added, depends on whether the 2010/87/EC Decision includes effective mechanisms that make it possible, in practice, to ensure compliance with the level of protection essentially equivalent to that guaranteed within the EU by the GDPR and that transfers of personal data pursuant to such clauses are suspended or prohibited in the event of the breach of such clauses or it being impossible to honour them.
As a conclusion, the Court stated, that the 2010/87/EC Decision imposes an obligation on a data exporter and the recipient of the data (the “data importer”) to verify, prior to any transfer, and taking into account the circumstances of the transfer, whether that level of protection is respected in the third country concerned, and that the 2010/87/EC Decision requires the data importer to inform the data exporter of any inability to comply with the standard data protection clauses, and where necessary with any supplementary measures to those offered by that clause, the data exporter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the data importer.
The Court also examined the validity of the Privacy Shield Decision, as the transfers at stake in the context of the national dispute leading to the request for preliminary ruling took place between the EU and the United States (“U.S.”). The Court considered that the requirements of U.S. domestic law, and in particular certain programmes enabling access by U.S. public authorities to personal data transferred from the EU to the U.S. for national security purposes, result in limitations on the protection of personal data which are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law, and that this legislation does not grant data subjects actionable rights before the courts against the U.S. authorities. Because of such a degree of interference with the fundamental rights of persons whose data are transferred to that third country, the Court declared the Privacy Shield adequacy Decision is invalid.
What does this mean for you?
If you are or were transferring data internationally, you are no longer able to rely on the Privacy Shield rule, and in order to transfer data to the US would need to check whether you can do so under the conditions laid down below.
Please note that further work is underway by the European Commission and EDPB to provide more comprehensive guidance on extra measures you may need to take. In the meantime, you should take stock of the international transfers you make and react promptly as guidance and advice become available.
The EDPB has recommended that you must conduct a risk assessment as to whether SCCs provide enough protection within the local legal framework, whether the transfer is to the US or elsewhere. The receiver of the data may be able to assist you with this.
We could assist you and review your privacy policy to ensure compliance with recent legal changes and your international data transfer. If we will conclude that your Privacy Policy is not compliant, we will have to amend it accordingly and to further consider the use of controller-to-processor standard contractual clauses.
Michael Iatsukha
