A Collection is a selection of features, articles, comments and opinions on any given theme or topic. It allows you to stay up‑to‑date with what interests you most.
Login here to access your saved articles and followed authors.
We have sent you an email so you can reset your password.
Sorry, we had a problem.
Tags related to this article
Published 13 November 2020
The week commencing 9 November 2020 has been a very busy one for data protection practitioners, the likes of which haven’t been seen since the closing weeks of May 2018.
You will no doubt be aware that the Schrems II judgment concluded that standard contractual clauses (SCCs) could only be used to make transfers to certain jurisdictions when accompanied by supplementary measures. On Wednesday 11 November, the European Data Protection Board (EDPB) published its guidance on what these supplementary measures look like in practice: Supplementary Transfer Measures Recommendations and European Essential Guarantees for consultation.
Then on Thursday 12th November, after years of waiting, the European Commission (EC) published its new set of draft standard contractual clauses. Of course, we can’t forget to mention the first entirely virtual all day data protection and cyber conference run by DAC Beachcroft on Tuesday 10 November!
We have to say that we are a little relieved that this plethora of guidance and clauses came just after our conference rather than just before it. However, that does leave us with an obligation to give you an update on the issues we discussed. On Tuesday, we had a number of questions regarding the future of data transfers and we are now pleased to provide some (if not all) of the answers.
As a reminder, in July 2020 in the case known as “Schrems II” (C-311/18), the Court of Justice of the European Union (CJEU) (i) invalidated the EU-U.S. Privacy Shield Framework; and (ii) ruled that, in certain circumstances, organisations could still rely on SCCs to transfer personal data from the European Economic Area (EEA) to the U.S. or any other country that the EU considers not to provide an adequate level of data protection. However, in order to rely on the SCCs for such transfers, the exporting organisation must undertake a case-by-case assessment of the transfer to assess whether an “essentially equivalent” level of protection for the personal data is provided under the third country’s laws, and where necessary implement “supplementary measures” to ensure such protection.
Shortly after the Schrems II judgment, the EDPB issued its FAQs and noted that it would provide more guidance on the “supplementary measures”. Its “Supplementary Transfer Measures Recommendations” set out the steps which should be taken when seeking to make a transfer outside the EEA to a jurisdiction which has not been deemed “adequate” by the EC. The EDPB advises data exporters to take the following 6 steps in order to ensure a compliant transfer.
The European Essential Guarantees purport to provide data exporters with guidance on the assessment to conduct in order to determine whether a third country provides a level of protection essentially equivalent to that guaranteed within the EU.
The EDPB considers that the applicable legal requirements can be summarised in four “European Essential Guarantees”:
Together these two documents form a lengthy and, at points, complex framework and methodology for making compliant overseas transfers. A detailed analysis of the practical consequences of this will take some time. At this point, we would highlight the following:
When do we need to comply with this guidance? This guidance applies with immediate effect and there is no grace period. For those organisations who have been slow off the mark following the Schrems II judgment, and have not yet concluded their data mapping exercise of international transfers, now is the time to bring a project team together to take action.
How will I make an assessment? You will have to make a detailed assessment of the type of data being sent, the access that might be granted to the data when overseas and an assessment of the legal regime in the countries where you are sending the data. We refer to these as “Transfer Impact Assessments”.
What if I am transferring encrypted data or pseudonymised data? Annex 2 of the Supplementary Transfer Measures Recommendations sets out a non-exhaustive list of the supplementary measures that could be put in place. It contains some insightful case studies where it is clear that strong encryption and pseudonymisation can work as a sufficient measure to ensure a compliant transfer so long as the data remains encrypted and pseudonymised throughout.
Will I have to stop certain transfers? The answer is "unfortunately yes". Case Study 6 of Annex 2 uses the example of a cloud service provider which requires access to unencrypted data to perform the service. The EDPB offers no solution to make this transfer compliant if the result of the analysis at Step 3 has concluded that the laws of the third country impinge on rights and protections granted by European data protection laws. One has to assume following Schrems II, that US laws impinge in a way that is not compatible with European data protection law.
The Supplementary Transfer Measures Recommendations are open for consultation until 30 November. The European Essential Guarantees are in final form.
So what of the fate of the SCCs themselves? A revised set has been awaited since the implementation of the GDPR. However, given the Schrems II case, the EC put its publication on hold.
Earlier this week at our Data Protection and Cyber Conference, we identified a number of questions regarding the replacement SCCs. Perhaps the EC was listening because it addressed those questions in its Draft Implementing Decision with proposed revised SCCs appended.
Here’s what you need to know:
Who will they cover? Perhaps the most exciting development is that the draft SCCs are structured in a “modular” format covering transfers between (i) controller to controller; (ii) controller to processor; (iii) processor to sub-processor; and (iv) processor to controller.
This approach allows much greater flexibility and plugs some fundamental gaps. It will be of particular comfort to those who had concerns regarding transfers from EU processors to UK controllers following the end of the Brexit transition period. In addition, the draft SCCs also contain a “docking” clause which allows addition parties to be added post execution.
What will change? The answer to this is “quite a lot”, although this was expected. The new SCCs mirror the requirements of the GDPR. The controller to processor “module” incorporates the requirements of Article 28, meaning that the SCCs can now be used as a complete document satisfying the contractual data protection requirements when engaging a processor. The new SCCs also attempt to address the concerns raised in the Schrems II judgment. In particular, there are specific sections dealing with local laws affecting compliance and obligations on the importer in the event of government access requests.
When will they be published? The draft version was published yesterday (12 November 2020). This draft will be available for consultation until 10 December 2020, following which a final version will be published. A timeline for this has not been announced but, given the Christmas break, we expect this to be in the new year.
How long will organisations have to implement the new SCCs? Organisations will have one year from the date of the final, approved EC decision to replace old SCCs in existing arrangements (unless any changes are made to the processing in the interim, in which case they should be implemented at that point). All new arrangements must be made on the basis of the new SCCs from the date of the final, approved EC decision. In relation to both new and existing arrangements, the requirement to carry out an assessment and, where required, implement supplementary measures, applies immediately.
Whilst the draft SCCs have provided answers to many of the conceptual questions, organisations will now need to ask themselves how they will go about implementing a programme of Transfer Impact Assessments and replacing existing SCCs.
If you haven’t started already, you need to map your data flows. As well as having a clear understanding of what data flows to which jurisdiction and under which transfer mechanism, you also need clarity regarding the specifics of the transferred personal data.
The next stage will be to perform Transfer Impact Assessments. Based on the draft EPDB Guidance, it is likely that the outcome of a number of these assessments will be the conclusion that the adequate data protection cannot be guaranteed in all of the circumstances and therefore the transfer cannot be made compliantly. Given the impending end of the transition period (and in the absence of an adequacy decision), organisations in the UK may be on the receiving end of such a decision.
A large “re-papering” exercise will be needed in the New Year. Whilst one year for implementation sounds like a long time, in reality, for many organisations the scale of the task will be enormous and may involve the mobilisation of a team.
Controllers should be prepared to be on the receiving end of the revised SCCs from processors which brings a new dynamic to those relationships.
London - Walbrook
+44(0)20 7894 6744
Darryn Hale, David Hill, Sophie Devlin
Aidan Healy, Christopher Air
Jade Kowalski, Christophe Wucher-North, Christopher Air, Alexander Dimitrov
Jade Kowalski, Pavan Trivedi
Jade Kowalski, Charlotte Halford, Rebecca Morgan
Jade Kowalski, Charlotte Halford, Eleanor Ludlam, Rebecca Morgan
Jade Kowalski, Ceri Fuller, Khurram Shamsee, Sophie Devlin, Christopher Air
Charlie Christie, Jade Kowalski
Ceri Fuller, Khurram Shamsee, Jade Kowalski, Sophie Devlin, Christopher Air