At its 50th meeting last Friday, the EDSA adopted a final version of its ‘Recommendations 01/2020 on measures to supplement transfer tools to ensure the level of protection of personal data under EU law’. Compared to the consultation version, there have been some relevant changes for companies, which we would like to present to you below.
Background and objective of the recommendations
With its recommendations, the EDPB aims to support controllers and processors in implementing the ‘Schrems II’ decision of the ECJ and the resulting requirements for data transfers to third countries, such as the USA. With the ‘Schrems II’ decision, the ECJ not only declared the adequacy decision for data transfers to the USA, the so-called EU-US Privacy Shield, invalid, but also established high requirements for data transfers based on standard contractual clauses. Since then, companies have been obliged to check whether the mere agreement of the clauses guarantees a sufficient level of data protection when transferring data to third countries on the basis of standard contractual clauses. The only relevant standard for this is European law, in particular the EU Charter of Fundamental Rights. If the assessment reveals that the mere agreement of the clauses is not sufficient to ensure an adequate level of data protection, which may be the case in particular where foreign security authorities have excessive access rights, additional safeguards must be put in place. This is precisely where the EDPB’s recommendations come in.
Overview of the main changes and their significance
Compared to the consultation version (PDF), the current and thus final version of the recommendations contains the following changes in particular:
- In paragraph 13, the EDPB clarifies that a contractual agreement on the location of data processing (data residency) can only exclude a transfer to a third country if there is a clear contractual agreement between the data importer and the data exporter and the data importer is established in the EEA.
- In paragraph 25, the supervisory authorities reiterate their view that exceptions for certain cases of third-country transfers (Art. 49 GDPR) must be interpreted narrowly.
- In paragraphs 28 et seq., the EDPB provides detailed guidelines on risk assessment in third countries. In paragraph 43.3, it explicitly describes a risk-based approach to assessing the level of protection in third countries, which takes into account, in particular, whether the exercise of critical state powers of access is likely in individual cases.
- In paragraph 44, the EDPB emphasises the data importer’s obligation to assist the data exporter in assessing an adequate level of protection.
- In paragraph 55, the EDPB clarifies that the assessment of the level of protection does not have to be repeated on an ongoing basis, but only needs to be supplemented in the event of relevant changes.
- There have been few relevant changes to the examples of supporting measures (paragraphs 74 ff. – Annex 2). Here, the EDPB continues to focus strongly on encryption and pseudonymisation.
- In paragraph 144 (Annex 3), the EDPB has significantly expanded the list of possible sources of information on the level of data protection in third countries, including, for example, transparency reports.
Risk analysis as the key – what companies now need to consider
The new recommendations from the EDPB cannot hide the fact that the legal situation regarding international data exchanges, particularly with the USA, remains complicated. EDPB Chair Andrea Jelinek has already warned that the impact of the ‘Schrems II’ decision should not be underestimated, even in light of the new recommendations. Companies should also be aware that individual data protection supervisory authorities have already initiated coordinated audits using questionnaires. Third-country transfers are thus under scrutiny, and urgent immediate measures are still recommended.
Regardless of this, from a business perspective, it is to be welcomed that the EDPB has opted for a risk-based approach in its final recommendations for assessing data protection levels in third countries. Against the backdrop of the recently published new standard data protection clauses of the EU Commission, this creates scope for greater legal certainty in data transfers to third countries. The key here is to carry out and document a risk analysis in each individual case, whereby the support of the data importer in the third country is particularly important. In discussions with the supervisory authorities, however, it is likely to be less promising to reject data transfers to third countries if the data exporter has contractually committed to processing the data exclusively within the EEA but does not have a branch here. Extensive recourse to the exceptions under Article 49 GDPR is also likely to prove equally critical.
Please feel free to contact us if you need assistance in reviewing your existing third country transfers or implementing the standard data protection clauses.
back