EDPB Issues Draft Guidance on Post-Schrems II GDPR Compliant Data Transfers Earlier this month, the European Data Protection Board (EDPB) issued its long-anticipated draf guidance on supplemental tools to ensure that data transfers out of the European Union (EU) to third countries comply with the GDPR. The guidance was necessary due to the landmark Schrems II decision in July 2020 by the Court of Justice of the EU, which invalidated the previously developed EU-US. “Privacy Shield” framework and, at the same time, clarified what companies transferring data outside of the European Economic Area (EEA) had to do ensure that such transfer provides the same level of protection for the data as that established in EU data protection law. The new draf guidance sets out the following roadmap for how to transfer data while remaining in compliance with the GDPR. Step One: Conduct Data Mapping The first step for data exporters is to ensure that they are “fully aware” of any cross-border transfers by mapping all data flows out of the EEA. This should occur as part of broader data mapping efforts, including considering whether any outside-the-EEA data processors might transfer the exported data to yet another third country or countries. Notably, the EDPB highlights the importance of mapping transfers involving remote access from a third country (e.g., in the context of IT support), as well as the use of cloud services located outside of the EEA. The EDPB also reminds data exporters to ensure that any data transferred is adequate, relevant, and limited to what is necessary for the purposes of transfer and processing. Step Two: Identify Transfer Mechanisms Afer a company maps its data flow, it must determine the appropriate transfer mechanisms for any cross-border transfers. Transfers made to a third country that the European Commission has found provides an adequate level of data protection may precede. Because the Court in the Schrems II decision determined that the Privacy Shield did not provide adequate data protection, U.S. companies must rely on another cross-border transfer mechanism, such as standard contractual clauses (SCCs) or binding corporate rules. Currently, the only SCCs available are those approved by the European Commission, subject to the EU Data Protection Directive (which preceded the GDPR), but a new version of the SCCs should be available soon: on November 12, 2020, the Commission published a draf implementing decision regarding updated SCCs. Future options may include model clauses drafed by supervisory authorities, codes of conduct, or certification mechanisms, as approved according to processes described in the GDPR. Cross-border transfers may also occur under certain “derogations,” such as explicit consent, in specific situations. Step Three: Assess the Effectiveness of the Transfer Mechanism in Light of Circumstances
According to the EDPB’s guidance, cross-border transfer mechanism alone may not be enough to ensure an adequate level of protection. As a result, it is essential that companies transferring data outside of the EEA ensure that whatever mechanisms they rely on are effective in practice. The EDPB envisions this as a highly fact-specific exercise. Reiterating the rationale behind Schrems II, the EDPB states that a transfer is not adequately protected “if the data importer is prevented from complying with their obligations under the chosen Article 46 GDPR transfer tool due to the third country’s legislation and practices applicable to the transfer.” Companies should consider in particular any laws of the third country granting public authorities access to personal data, whether for the purpose of law enforcement, regulatory supervision, or natural security. For transfers into the United States, this would include a review of laws governing law enforcement investigative subpoenas, warrants, and other court orders issued under, for example, the federal Stored Communications Act provisions that are part of the federal Electronic Communication Privacy Act, as well as access for counterintelligence investigations under the Foreign Intelligence Surveillance Act. These assessments should be documented thoroughly. Step Four: Adopt Supplementary Measures if Transfer Mechanisms are Insufficient Should a company’s assessment reveal that its chosen transfer mechanisms are insufficient to uphold EU standards of data protection, it must adopt additional protective measures. The EDPB’s guidance states that contractual and organizational measures alone are likely sufficient to “overcome access to personal data by public authorities of the third country,” and that technical measures will ofen be the only adequate means to provide sufficient protection, particularly with regard to surveillance. Such technical measures include, for example, encryption, pseudonymization, and split or multi-party processing. Step Five: Adopt Formal Procedural Steps Depending on the particular transfer tool being used in Article 46 of the GDPR, companies should then adopt any procedural steps that are necessary in order to implement effective supplementary measures. These steps will vary depending on the Article 46 transfer mechanism adopted. For example, in certain cases, modifying SCC’s requires advance authorization from the relevant supervisory authority. Guidance on ad hoc contractual clauses remains under consideration by the EDPB, which will provide more details “as soon as possible.” Step Six: Re-evaluate Transfers On An On-going Basis Compliance with the GDPR’s restrictions on cross-border transfer – like compliance with the GDPR overall – is an on-going commitment. Companies must continue to monitor developments in third countries that could affect the scope and effectiveness of data protection within those countries. The EDPB guidance states explicitly that companies should implement mechanisms to suspend or terminate transfers when supplementary measures are no longer effective in third countries.
Next Steps for the Draft Guidance The draf guidance is open for public consultation until November 30, 2020. This guidance makes it clear that each company transferring data outside of the EEA is directly accountable for examining its cross-border data transfers and putting appropriate compliance measures in place. Companies engaged in such transfers should ensure that cross-border data transfer mechanisms are part of their continued GDPR compliance efforts. U.S. companies in particular should take note of this draf guidance following the Schrems II decision, which was based largely on the conclusion that U.S. surveillance and national security authorities created a situation in which data transfers into the United States were not adequately protected.