Arjen Schram, 4 December 2020

Transfer of personal data to third countries after Privacy Shield invalidated

Many companies based in the European Union transfer personal data to, for example, affiliated companies or third parties based in the United States. That ‘transfer’ of personal data did not pose a legal problem under the so-calledPrivacy Shield. However, the Court of Justice declared the Privacy Shield invalid overnight on 16 July 2020 in the Schrems II case. That landmark court decision created a lot of ambiguity regarding the legality of personal data transfers from the EU to the US. Therefore, on 10 November 2020, the European Data Protection Board (“EPDB“), or the European Data Protection Board, published a set of recommendations on the transfer of personal data to third countries. In this blog, we focus on the invalidated Privacy Shield and the EDPB’s recommendations.

AVG and third-country transfers

The General Data Protection Regulation is directly applicable throughout the EU and thus allows the transfer of personal data from one European member state to another without further ado. This is not surprising, as all Member States are, after all, supposed to guarantee the level of protection guaranteed by the Regulation. However, transfers of personal data to countries outside the EU, so-called ‘third countries’, are allowed to a much more limited extent. The transfer of personal data to those countries requires an adequacy decision taken by the European Commission or other ‘appropriate safeguards’. In the case of an adequacy decision, the European Commission decides that an entire country, sector or organisation provides an adequate level of protection for the processing of personal data. Once an adequacy decision has been made, the transfer of personal data can take place without obstacles. If an adequacy decision is lacking, the transfer of personal data is only possible if appropriate safeguards are provided. These must be provided by the controller or processor itself to ensure that data subjects have enforceable rights and effective legal remedies. As appropriate safeguards, the AVG lists, among others, standard data protection clauses (also known as model contracts) adopted by the European Commission, an approved code of conduct or binding corporate rules.

Privacyshield and Schrems II

An adequacy decision previously existed for the transfer of personal data to the United States. The European Commission thereby allowed organisations in the European Union to exchange personal data without obstacles with US-based organisations affiliated to the so-called “Privacy Shield”. However, the European Court of Justice invalidated this adequacy decision on 11 July 2020 in the Schrems II case. Briefly, the court reached that decision because US legislation allows intelligence and security agencies the right to access and use data of European Union citizens, without strictly necessary. In doing so, the court concluded that the transfer of personal data to the United States was not in line with the requirements of the AVG. This landmark court decision created a lot of confusion. Indeed, from one day to the next, this meant that the common transfer of personal data to the US was no longer in line with the General Data Protection Regulation.

EDPB recommendations

In an attempt to clear up this ambiguity, the EDPB published on 10 November 2020 a set of recommendations for the transfer of personal data to third countries. The EDPB notes that, among other things, standard clauses (aka model contracts), an approved code of conduct and binding corporate rules have not been declared invalid by the ECJ. However, this does not mean that their use is automatically an appropriate alternative to the invalidated adequacy decision. Model contracts, an approved code of conduct or binding corporate rules can provide a basis for the transfer of personal data to third countries, but when using them, you need to be aware of a number of issues on an ongoing basis. The EDPB provides the following roadmap as an aid in this regard:

• Step 1: Be aware of the personal data you transfer to third countries;
• Step 2: Know which transfer instruments you use to transfer that personal data to third countries;
• Step 3: Assess whether there is anything in the law or practice of these third countries that may impair the effectiveness of the appropriate safeguards of the transfer instruments used;
• Step 4: On this basis, determine whether additional measures are needed to bring the level of protection of the transferred personal data up to the EU standard;
• Step 5: Take all procedural steps necessary for the adoption of the additional measures. For example, in some cases this may require you to consult the Personal Data Authority;
• Step 6: Regularly evaluate the level of protection of the personal data you transfer to the third country. In doing so, keep track of any developments that may affect it.

It should be clear that the transfer of personal data to the United States is no longer as self-evident as it was under the Privacy Shield. The recently published recommendations of the EDPB are only a tool to implement personal data transfers to third countries as effectively as possible. If your organisation has to deal with the transfer of personal data to third countries – and this is more likely than you may think – we would be happy to help you think through how to comply with the requirements of the AVG!