Chapter 2I: International Data Transfers

Question 1

Transfers of personal data to any country outside the EEA may only take place subject to the conditions of Chapter 5 of the regulation, namely…

Answer 1

The country ensures an adequate level of protection as determined by the European Commission

In the absence of adequate level of protection, the controller or processor wishing to transfer the data provides appropriate safeguards on the condition that enforceable data subject rights/effective legal remedies are available for data subjects

Or in the absence of adequate level of protection, a transfer fits within one of the derogations for specific situations covered by the Regulation.

Question 2

Do the rules regarding international transfers apply to an international organisation?

Answer 2

Yes.

Recital 101 recognises that cross-border flows of personal data are necessary for the expansion of international trade but level of protections should not be undermined.

Question 3

What impact has the rule re: international transfers and multi-national organisations had?

Answer 3

The adoption of EU data protection practices across their operations regardless of where the data processing activities actually take place.

Question 4

Does data transitioning through a third country fall under the remit of the regulation’s requirements?

Answer 4

No - data routed through a third country en route does not bring transfer within the scope of the restriction of the regulation unless some substantive processing operation is conducted on the personal data in that third country.

Question 5

Two common situations that have been a source of concern in the past but are not subject to conditions dealing with data exports:

Answer 5

• Technical routing of packet-switch technology, such as internet email and web pages, which may involve random transfers of personal data between computers located anywhere
• Electronic access to personal data by travellers who happen to be physically located for a short period of time in a place that does not afford an adequate level of protection (e.g. a person who logs on to a computer system based in the EU to access data from a foreign airport)

Question 6

What was the Swedish case against Bodil Lindqvist (C-101/01) in November 2003 and what did the European Court of Justice rule?

Answer 6

An individual in a member state loaded personal information onto a website that is hosted in that state or another member state so that personal data can be accessed by anyone who connects to the internet - ECJU ruled that this does not constitute a transfer of data.

Question 7

When should data movement be classified as a ‘transfer’?

Answer 7

An international exchange of information about individuals with the intention of automatically processing it after the exchange - even if the original exchange does not qualify (e.g. a customer in the EU provides information over to telephone to someone in a third country, which is then entered on a computer)

Question 8

What elements should be taken into consideration when defining ‘adequate level of protection’? (Article 45(1))

Answer 8

The rule of the law, respect for human rights and fundamental freedoms, relevant legislation, data protection rules, enforceable rights and judicial redress for data subjects

The existence and effective functioning of an independent supervisory authority in the country to which an international organisation is subject, including adequate enforcement powers

International commitments the third country or international organisation has entered into or other obligations arising from legally binding conventions or instruments

Question 9

Who assesses / decides whether a third country provides adequate protection?

Answer 9

The European Commission.

Question 10

The Commission is guided by the criteria set out in WP29’s Adequacy Referential dated 6 February 2018 when assessing adequacy of a country - what does this referential document do?

Answer 10

Establishes the core data protection principles that have to be present in a third-country framework or international organisation in order to ensure essential equivalence with the EU framework.

Question 11

How often should adequacy decisions be reviewed?

Answer 11

Every 4 years - taking into account all relevant developments in the third country. The commission is entitled/required to repeal, amend or suspend the decision.

Question 12

What countries have been recognised as having adequate protection by the Commission (under the directive or the regulation)?

Answer 12

Directive: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay

Regulation - Japan

Question 13

What was Safe Harbor?

Answer 13

The Safe Harbor mechanism was a self-regulatory framework that would allow organisations to satisfy the requirements of EU data protection law in respect of transatlantic data transfers.

Question 14

When did the Commission issue a decision that Safe Harbour Privacy Principles provided adequate protection for personal data transferred from the EU?

Answer 14

26 July 2000 following extensive negotiations - this decision enabled transfers to US based companies who agreed to abide by the Safe Harbour Privacy Principles.

Question 15

What about Safe Harbour attracted criticism?

Answer 15

Self-certification nature and non-EU style of its provisions
Participants did not perform required annual compliance checks
Lack of active enforcement by the Federal Trade Commission (FTC).

Question 16

What was the ‘Snowden effect’?

Answer 16

Disclosures by Edward Snowden in June 2013 about mass surveillance operations carried out by the US National Security Agency (NSA) which has a very visible knock-on effect on the way the EU regulates international transfers of personal data.

This, combined with existing criticisms of Safe Harbour, led to calls for the suspension of the framework - the commission rejected this on fears that suspending the framework would adversely effect EU business interests and transatlantic economy - they reopened the dialogue with the US to strengthen framework.

Question 17

When was renegotiation of Safe Harbour announced?

Answer 17

27 November 2013 via two communications to the European Parliament and the Council of the European Union - recognised that the Snowden revelations had damaged trust and that this needed to be rebuilt.

Question 18

When did the Commission begin discussions with US authorities re: updating Safe Harbour Framework?

Answer 18

January 2014.

Question 19

How many recommendations did the Commission provide on the revision of Safe Harbour?

Answer 19

13 specific recommendations aimed at addressing Safe Harbor’s weaknesses and ensuring that the framework remained as an effective mechanism in facilitating commercial transatlantic data flows; focused on four broad priorities - transparency, redress, enforcement and access to data by US authorities.

Question 20

In June 2014, the Commissioner provided an update on negotiations re Safe Harbour II, reporting that…

Answer 20

The Department of Commerce (DOC) has agreed to 12 of the commission’s 13 recommendations - the final recommendation that the national security exception was to be applied only when strictly necessary and proportionate.

Question 21

Who lodged a complaint with the Irish Data Protection requesting the termination of any transfers of personal data by Facebook Ireland to the US, questioning the validity of Safe Harbor?

Answer 21

Maximillian Schrems, Austrian Law Student. Schrems claimed that Facebook (as data controller) could no longer rely on the Safe Harbour framework to legitimise transfers of his data to the US because of the wide access that US intelligence agencies had to such data revealed by Snowden.

Question 22

What happened with Schrem’s complaint re Facebook Ireland <> US?

Answer 22

Escalated to Irish High Court and then onto the CJEU - on Oct 6 2015, CJEU declared the Safe Harbor adequacy decision invalid - placing pressure on the Commission to agree a more robust mechanism for transfers of data from the EU to the US.

Question 23

When was the draft decision on the adequacy of the new EU-US Privacy Shield released?

Answer 23

29 February 2016 after more than two years of negotiations with the DOC.

Question 24

What were the increased benefits of Privacy Shield?

Answer 24

Documentation is significantly more detailed, imposing specific and exact measures on organisations wishing to join the framework.

Also includes additional checks and baalnces designed to ensure privacy rights of EU individuals can be exercised when their data is being processed in the US.

Question 25

On 13 April 2016, WP29 published an opinion setting out a detailed analysis of Privacy Shield, in which they set out concerns…

Answer 25

• Commercial aspect of Privacy Shield
• The ability for US public authorities to access data transferred under Privacy Shield
• Privacy Shield did not include key data protection principles from EU law
• Concern re: onward data transfers
• Redress procedure too complex
• Documentation did not exclude massive and indiscriminate collection of personal data by US intelligence agencies
• New ombudsperson not sufficiently independent or powerful

Opinion concluded urging for these concerns to be resolved to improve the Privacy Shield.

Question 26

After further negotiations to address WP29’s concerns, the commission finally issued its adequacy decision concerning Privacy Shield on… and entered it into force on…

Answer 26

Issued - 12 July 2016

Entered into operation 1 August 2016

Question 27

How could businessed subject to the jurisdiction of the FTC or Department of Transportation register with Privacy Shield?

Answer 27

Filling out an online registration with the Department of Commerce.

Question 28

What were the 7 principles of Privacy Shield?

Answer 28

Notice
Choice
Accountability for onward transfer
Security
Data integrity and purpose limitation
Access
Recourse, enforcement and liability

Question 29

Companies who self certified compliance with Privacy Shield had to demonstrate compliance by…

Answer 29

Conducting an internal compliance assessment and, to the extent that there any gaps in its ability co comply, adopt internal controls policies and procedures to make compliance.

Register with a third party arbitration provider to handle any complains from EU individuals about handling of their information if unable to resolve. and pay registration fees.

Adopt a Privacy Shield notice that contains 13 specified details about the company’s privacy practices and publish online.

Question 30

Why was Privacy Shield invalidated?

Answer 30

The CJEU’s reasoning for the invalidation of Privacy Shield was twofold: US law gives US authorities the right to collect personal data about EU data subjects without adequate safeguards. EU data subjects lack effective means to seek redress against the U.S. government.

Question 31

What solutions are in place for countries deemed inadequate?

Answer 31

There are several possible mechanisms:

• Legally binding and enforceable instrument between public authorities/bodies
• Binding corporate rules in ac. with Article 47
• Standard data protection clauses adopted by the commission or supervisory authority
• An approved code of conduct (Article 40) and binding enforceable commitments to apply appropriate safeguards and data rights
• Approved certification mechanism (Article 42) and binding enforceable commitments to apply appropriate safeguards and data rights
• Contractual clauses between controller/processor/third country or provisions inserted into administrative arrangement between public authorities or bodies, specifically approved for that purpose by the competent data protection supervisory authority

Question 32

What are standard contractual clauses?

Answer 32

A contract preapproved by the Commission establishing certain obligations applicable to exporters and importers aimed at safeguarding personal data in accordance with EU standards.

Question 33

When did the Commission adopt the decision that set out standard contractual clauses, obliging member states to recognise companies using these clauses in contracts concerning personal data transfers outside the EEA were offering adequate protection to data?

Answer 33

15 June 2001 and second decision in 27 December 2001

Second version 27 December 2004.

Question 34

The inflexible nature of the original 2001 controller to processor clauses led to a further proposal by…

Answer 34

The International Chamber of Commerce (ICC), which resulted in the Commission on 5 February 2010 updated and replaced the original controller to processor standard clauses with a new set of model clauses. These have had to be used since 2010 for new processing operations.

Question 35

Sets of standard contractual clauses will remain valid until replaced or amended by new versions - what are they?

Answer 35

2001 Controller to controller
2004 Alternative controller to controller
2010 controller to processor

Question 36

Who challenged the ‘existing’ (previous) SCCs?

Answer 36

Irish Data Protection Commissioner, who asked High Court of Ireland to refer their validity to the CJEU.

Question 37

Some technology companies have pioneered the idea of getting their own clauses approved to enjoy greater flexibility in how they commit to data protection - companies such as…

Answer 37

Microsoft, Google, Amazon Web Services

Question 38

Code of conduct and certification mechanisms are yet to be tested; true or false?

Answer 38

True

Question 39

The regulation includes BCRs as a mechanism available to…

Answer 39

Both controllers and processors to legitimise transfers within corporate groups.

Question 40

In 2003, the EU DPAs developed the concept of BCRs to…

Answer 40

Allow multinational organisations and groups of companies to make intra-organisational transfers of personal data across borders in compliance with EU data protection law.

Question 41

What are BCRs?

Answer 41

A global set of rules based on European privacy standards which multinational organisations draw up and follow voluntarily and national regulators approve in accordance with their own legislations.

Question 42

Where was the idea of using BCRs to create adequate safeguards originally devised?

Answer 42

By WP29 in Working Document WP74.

Question 43

EU DPAs increased level of cooperation to streamline the BCRs approval process, which led to the adoption of…

Answer 43

A mutual recognition process, effectively incorporated into the regulation.The WP29 issued detailed guidance on the approval process in WP263.

Question 44

According to the Regulation, DPAs must approve a set of BCRs following the so-called consistency mechanism provided that it is legally binding and expressly confers enforceable rights on data subjects. A full and valid set of BCRs should include…

(Later endorsed by the EDPB)

Answer 44

Structure and contact details of the corporate group

Data transfers including categories of personal data, type of processing and purposes, type of data subjects affected and identification of third country

Legally binding nature

Application of general data protection principles

Rights of data subjects

Acceptance of liability for any breaches of BCRs

The way information on BCRs is provided to DSs

Tasks of any DPO or other person in charge of monitoring compliance

Complaints procedures

Mechanisms for ensuring verification of compliance

Mechanisms for reporting/recording changes of rules to the supervisory authority

Cooperation mechanism with the Supervisory Authority

Mechanisms for reporting to the competent supervisory authority any legal requirements

Appropriate DP training to personnel having permanent or regular access to PD

Question 45

In the absence of an adequate level of protection or of appropriate safeguards, a transfer or a set of transfers of personal data may still take place if it fits within one of the derogations for specific situations covered by the Regulation.
The EDPB confirmed that deorgations must be…

Answer 45

Interpreted restrictively and only relied on as a last resort, when the provision of adequate protection/appropriate safeguards for personal data transferred is not possible.

Question 46

Consent is a derogation for international transfers, but must be…

Answer 46

Specific, informed and explicit.
Individual must be informed of possible risks of such transfers due to absence of an adequacy decision and appropriate safeguards.

Public authorities are not able to rely on this derogation.

Question 47

Contract performance is a derogation for international transfers, but must be…

Answer 47

Entered into at the individual’s requests or in their interests, or necessary for the performance or conclusion of the contract.

If a transfer is not necessary and the exporter has chosen to structure its operations in a way that involves transferring data overseas, this is not enough. It must be necessary.

Question 48

Substantial public interest is a derogation for international transfers, but is most likely to apply when…

Answer 48

Transfer is necessary for reasons of crime prevention and detection, national security and tax collection.

Question 49

Legal claims is a derogation for international transfers, which means…

Answer 49

Transfers can be made when necessary for establishing, exercising or defending legal claims.

Question 50

Vital interests is a derogation for international transfers, which means…

Answer 50

That this relates to matters of life or death, such as the transfer of medical records of an individual who has become seriously ill or involved in a serious accident abroad.

Question 51

Public registers is a derogation for international transfers, which means…

Answer 51

Exports of personal data can also be made from information available on a public register provided that the person to whom the information is transferred complies with any restrictions on access to or use of the information in the register.

Question 52

Not repetitive transfers is a derogation for international transfers, which means…

Answer 52

a transfer may take place if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data.
In these situations, the controller must inform the supervisory authority and the data subject of the transfer. The individual must also be informed of the compelling legitimate interests pursued by the controller.