Transfer of Data to the USA Now Blocked?
By Piotr Zawadzki, Penteris
On 16 July 2020, the Court of Justice of the European Union (CJEU) issued a landmark judgment invalidating the EU-US Privacy Shield. The CJEU also confirmed that standard contractual clauses (SCCs) for the transfer of personal data to third countries are valid, although require additional attention. The problem concerns both those entities that send data to the US themselves and all persons or organisations that use contractors/providers using servers, data centres and other infrastructure located in the US.
Entities that transfer data to the US can no longer use the Privacy Shield. Unless they have implemented alternatives, they should stop data processing in the US. Traders using SCCs may continue, but they are liable for their proper execution by the recipients.
The use of SCCs in contracts with the recipients has until now been considered a means to allow for legitimate data transfer outside the EEA. However, the Schrems II ruling means that simply adding provisions whose wording corresponds to standard clauses will not protect against a breach of data protection rules. Where local laws do not allow the recipient to fully comply with their SCCs-based duties, its use may be questioned (in the US this may apply to certain categories of recipients, so using SCCs as a convenient alternative to the Privacy Shield will most probably not be an option).
Nevertheless, in all cases supplementing contracts with counterparts that complement standard clauses should be considered. These could include additional guaranties for the implementation of data protection safeguards as well as on the reporting of the manner, status, or risks to the fulfilment of obligations imposed by the clauses.
It is also recommended that a Data Protection Impact Assessment (DPIA) be carried out in relation to individual third countries and importers, and that associated risks be documented.
Piotr ZawadzkiGGI member firm
Law Firm Services
T: +48 22 257 83 00
Published: GGI Insider, No. 109, September 2020 l Photo: vschlichting - stock.adobe.com