Chapter 12 (International Data Transfers) Flashcards
(34 cards)
Transfers of personal data to any country outside of the European Economic Area (EEA) May only take place under what 3 conditions laid out in Chapter 5 of the GDPR?
- The third country ensures an adequate level of protection (as determined by the Commission) for the personal data
- In the absence of adequate levels of protection, the controller or processor wishing to transfer the data provides appropriate safeguards on the condition that enforceable data subject rights and effective legal remedies for data subjects are available.
- In the absence on an adequate level of protection or of appropriate safeguards, a transfer or set of transfers of personal data fits within one of the derogations for specific situations covered by the GDPR.
What element of the GDPR will continue to be a serious barrier to international commerce?
Meeting adequacy requirements for data transfers.
What are 3 situations not within the scope of a data transfer for GDPR purposes?
- Technical routing of packet-switching technology, such as internet email, which may involve random transfers of personal data between computer servers located anywhere in the world.
- Electronic access to personal data by travelers who happen to be physically located for a very short time in a place that doesn’t afford an adequate level of protection.
- Merely loading personal info onto a website that is hosted in that state or another member state so the info can be accessed by anyone who connects to the internet
Does an intentional exchange of info about individuals with the intention of automatically processing that personal info after it has been exchanged qualify as a transfer for purposes of the GDPR
Yes.
What 3 elements does the Commission take into consideration when assessing whether a third country or an international org has an adequate level of protection?
- The rule of law; respect for human rights and fundamental freedoms; relevant legislation re public security, defense, national security, and criminal; implementation of such legislation, data protection rules, professional rules and security measures; and effective and enforceable data subject rights
- The existence and effective functioning of one or more independent supervisory authorities charged with ensuring and enforcing data protection rules.
- The international commitments the third country or international org concerned has entered into, or the other obligations arising from legally binding conventions or instruments.
If the Commission determines an adequate level of protection exists it creates an implementing act that provides what 3 things?
- Mechanism for a periodic review (at least every 4 years) considering all recent developments in the third country or international org.
- Specificity of its territorial and sectoral application
- Identification of the supervisory authority or authorities for ensuring and enforcing compliance with the data protection rules (where applicable)
Under the Directive, what 11 countries did the Commission recognize as having adequate protection for personal data?
- Andorra
- Argentina
- Canada
- Faroe Islands
- Guernsey
- The Isle of Man
- Israel
- Jersey
- New Zealand
- Switzerland
- Uruguay
Under the GDPR what 3 countries has the Commission recognized as having adequate protection for personal data?
- Japan
- South Korea
- United Kingdom
Due to the large volume of data transferred between the US and the EU the Commission and the US Department of Commerce originally developed what as a self-regulatory framework allowing the Directive’s requirements for cross-border data transfers to be met?
The Safe Harbor mechanism
What were 2 perceived weaknesses of the Safe Harbor framework?
- The fact that participants didn’t perform required annual compliance checks
- Lack of active enforcement by the FTC compared to other domestic cases
What had a very visible effect on the way the EU regulated international transfers of personal data?
The disclosures by Edward Snowden in June 2013 about the mass surveillance operations carried out be the NSA.
What 4 broad priorities did the Commission focus on to help address the Safe Harbor’s weaknesses and ensure a mechanism for facilitating commercial trans-Atlantic data flows?
- Transparency
- Redress
- Enforcement
- Access to data by US authorities
On October 6, 2015 the CJEU issued a decision on Maximilian Schrems case against Facebook Ireland that decided what?
That the Safe Harbor adequacy decision was invalid so Facebook couldn’t rely on it to legitimize cross-border data transfers.
What framework replaced the Safe Harbor framework?
The EU-US Privacy Shield Framework
When did the Commission release its draft decision of the new EU-US Privacy Shield Framework?
February 29, 2016
What 5 concerns did the WP29 raise regarding the 2016 Privacy Shield framework?
- The commercial aspects of the Privacy Shield
- Ability for US public authorities to access data transferred under the Privacy Shield
- Lack of certain key data protection principles from EU law
- Protection for onward data transfers
- Allowing massive and indiscriminate collection of personal data originating from the EU by US intelligence agencies
When did the Privacy Shield formally enter into effect?
August 1, 2016
What were the 7 principles included in the Privacy Shield?
- Notice
- Choice
- Accountability for onward transfer
- Security
- Data integrity and purpose limitation
- Access
- Recourse, enforcement, and liability
The Privacy Shield required companies self-certifying compliance to take what 3 steps?
- Conduct an internal compliance assessment to determine the company’s ability to comply with the principles with respect to info covered by the certification.
- Registering with a third-party arbitration provider to handle any complaints from EU individuals about the handling of their info that the company was unable to fully resolve and paying any registration fee.
- Adopting a Privacy Shield notice containing 13 specified details about the company’s privacy practices and publishing the notice online.
What did the Schrems II decision issued by the CJEU in July 2020 declare?
It invalidated the Privacy Shield because it determined domestic US law regulating access and use by US authorities of personal data transferred from the EU to the US were not circumscribed in a way to provide protections essentially equivalent to those required by EU law.
What is the name of the framework being worked on to replace the Privacy Shield?
Trans-Atlantic Data Privacy Framework
What are 7 possible mechanisms that provide appropriate safeguards for international data transfers?
- A legally binding and enforceable instrument between public authorities or bodies
- BCRs
- Standard data protection clauses adopted by the Commission
- Standard data protection clauses adopted by a supervisory authority and approved by the Commission
- An approved code of conduct pursuant to article 40, together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards
- An approved certification mechanism pursuant to Article 42, together with binding and enforceable commitments of the controller or processor in the third country to apply appropriate safeguards
- Contractual clause between the controller or processor
Traditionally, the most frequently used mechanism to legitimize international data transfers to countries that are not deemed to provide an adequate level of protection are what?
Standard Contractual Clauses (SCCs)
What did the Schrems II decision say about SCCs?
That they could continue to be used for the purpose of legitimizing data transfers, but in some circumstances it might be necessary to supplement them with additional safeguards.
