International transfers

Question 1

Which European body is responsible for making adequacy decisions?

Answer 1

The European Commission

Question 2

How often are adequacy decisions reviewed?

Answer 2

Every four years

Question 3

Which countries are adequacy decisions in place with?

Answer 3

Argentina
Uruguay
Faroe Islands
Isle of Mann
Guernsey and Jersey
Andorra
Switzerland
Israel
Japan (only covers private sector organisations)
New Zealand
Also USA (under privacy shield) 
Canada (data protected by PIPEDA only, which is applicable to commercial organisations. Adequacy doesn’t cover all all forms of personal data)

Question 4

How often does Privacy Shield certification need to be renewed?

Answer 4

Annually

Question 5

If you load personal data onto a UK server which is then available through a website, and you plan or anticipate that the website may be accessed from outside the EEA, is this a restricted transfer?

Answer 5

you should treat this as a restricted transfer (ICO)

Question 6

If you want to transfer personal data to a US organisation under the Privacy Shield, what are the two things you need to check?

Answer 6

• Check on the Privacy Shield list to see whether the organisation has a current certification
• Make sure the certification covers the type of data you want to transfer.

Question 7

What are the options are available if you want to make a restricted transfer (in order of preference)

Answer 7

• Adequacy decisions
• Appropriate safeguards (which are set out in the GDPR)
• Derogations

If none of these apply, then the transfer would be in breach of GDPR

Question 8

What are the 3 things you’re obliged to tell the data subject about data transfers?

Answer 8

• Intent to transfer data internationally
• Existence (or lack of) an adequacy decision
• Safeguards that are in place

Question 9

What are “appropriate safeguards”?

Answer 9

They are legal tools designed to ensure recipients of data, who are outside the EEA, are bound to continue to protect personal data to a European-like standard
Mechanisms that can be used to recipients to commit to protecting personal data and facilitate ongoing, systematic cross-border transfers

Question 10

Give some examples of appropriate safeguards when it comes to international transfers of data outside the EU

Answer 10

• Binding corporate rules
• Standard contractual clauses
• Approved codes of conduct and certification mechanisms
• Ad hoc contractual clauses
• Reliance on international agreements

Question 11

What are the three over-arching options for international transfers under the GDPR?

Answer 11

1. Adequacy decisions
2. International safeguards
3. Derogations

Question 12

Before you even think about data transfers, what do you need to make sure you have?

Answer 12

A legal basis for processing the data

Question 13

If you’re transferring data internationally, what are you obliged to tell the data subject(s)?

Answer 13

• Notify them of your intent to transfer personal data internationally
• Existence of an adequacy decision
• what Safeguards are in place

Question 14

As well as territories, what else can adequacy decisions apply to?

Answer 14

Under GDPR, adequacy decisions can also apply to sectors (e.g. regulated financial or healthcare sectors)
And
International organisations

Question 15

Which European body is responsible for making adequacy decisions?

Answer 15

The European Commission

Question 16

How often are adequacy decisions made under the Data Protection Directive reviewed?

Answer 16

Decisions made under the Data Protection Directive will remain in force until amended, replaced or repealed

Question 17

What factors must the European Commission take into account when making adequacy decisions?

Answer 17

Respect of the rule of law
Access to justice
International human rights standards
Law (inc case law)
Effective and enforceable rights for individuals (inc judicial redress)
Data protection rules, professional rules and security measures (inc around onward transfers)
Other international commitments and obligations

Question 18

Is EU-US Privacy Shield self-certified?

Answer 18

Yes

Question 19

What recourse mechanisms does Privacy Shield offer?

Answer 19

• Internal complaint process
• Independent dispute resolution provider
• Department of Commerce or Federal Trade Commission
• Binding arbitration

Question 20

What are “appropriate safeguards”?

Answer 20

They’re legal tools designed to ensure that recipients of data, who are outside the EEA, are bound to continue to protect personal data to a European-like standard

Question 21

What are binding corporate rules?

Answer 21

BCR are a form of appropriate safeguard
they’re designed to allow large, multinational companies to adopt a policy suite with rules for handling personal data that are binding on the company.
They have to be signed off by a competent supervisory authority and are legally binding
They confer enforceable rights on data subjects

Question 22

What are standard contractual clauses also known as?

Answer 22

Model clauses

They are a form of appropriate safeguard

They are a standard form which is non-negotiable

Question 23

What is most commonly used tool for appropriate safeguards?

Answer 23

Standard contractual clauses (aka model clauses)

Question 24

What must ad hoc contractual clauses have if they are to be used as a tool for delivering Appropriate Safeguards?

Answer 24

They must have supervisory authority authorisation

Question 25

Appropriate Safeguards: reliance on international agreements | Give an example

Answer 25

Passenger name records when someone flies from EU to US | The US has an agreement with the EU to facilitate the transfer of this data

Question 26

What is a derogation and when should it be used?

Answer 26

A derogation is an exemption from the prohibition on transferring personal data outside of the EAA Derogations are used as a last resort, when an there isn’t an adequacy decision and appropriate safeguards are not in place They allow organisations to transfer personal data across borders under very specific conditions

Question 27

What options exist for derogations?

Answer 27

- Explicit consent from the data subject - Where it is necessary for performance of a contract with the data subject - Public interest (when recognised by EU/member state law only) - Establishment, exercise or defence of legal claims (to cover international litigation scenarios) - Protection of vital interests of the data subject (or other person) - emergency situations only (e.g. provision of medical care) - Transfer from a register of public information - Legitimate interests of the controller - BUT must be limited and concern a limited number of individuals. Provisions are very narrow

Question 28

Do we have an adequacy decision with Argentina?

Answer 28

Yes

Question 29

Are approved codes of conduct and certification mechanisms appropriate safeguards for international data transfers?

Answer 29

Yes | Along with standard contractual clauses and binding corporate rules

Question 30

What is a derogation?

Answer 30

An exemption from the prohibition on transferring personal data outside of the EEA. Used when there isn’t an adequacy decision and appropriate safeguards aren’t in place Derogations are for limited circumstances

Question 31

List out the circumstances in which derogations can apply

Answer 31

- Consent (subjects must understand the possible risks of the transfer) - Performance of contract (there must be no way to fulfil the contract unless the data is transferred. Good example, is hotel booking in 3rd country) - Public Interest (must be recognised in EU or member state law) - Establishment, exercise or defence of legal claims (int’l litigation) - Protection of vital interests of data subject or other persons (e.g. emergency medical care) - Transfer from a register of public information (conditions apply) - Legitimate Interests (must be non-repetitive and concern a Ltd number of individuals). Also have to notify the data subject and supervisory authority of the transfer

Question 32

What do BCRs deal with (and what do they not cover)?

Answer 32

They (only) deal with intra-organisational transfers and not with transfers to 3rd parties BCRs are specifically designed to provide adequate safeguards within multiple-national corporations who move data within their corporation

Question 33

Organisations that are not established in the EU, but that monitor behaviour are subject to the GDPR - when?

Answer 33

A) the offering of goods and services to data subjects in the EU B)When the behaviour being monitored occurs within the EU EDPB: The behaviour monitored must first relate to a data subject in the Union and, as a cumulative criterion, the monitored behaviour must take place within the territory of the union Note - the monitoring bit covers a lot of advertising and marketing use cases including behavioural advertising, geo-localisation activities for marketing, fingerprinting etc