Do you transfer personal data outside the EU?
Because you outsource (including Cloud storage), for example? Or because you’re an international organisation?
Then you need to put appropriate safeguards in place.
This isn’t just to ensure compliance with the GDPR (General Data Protection Regulation):
Using the GDPR as the catalyst for better business practicesYou don’t need to view the GDPR as a compliance headache.
Yes, the Regulation grants personal data a level of protection not automatically guaranteed outside the EU. And it aims to prevent EU residents from losing that protection once their data leaves the EU, so restricts international transfers. (That’s transfers to ‘third countries’ – i.e. non-EEA countries.)
The GDPR therefore permits international transfers only if you’ve implemented sufficient safeguards – adequate security measures and an appropriate transfer mechanism.
This isn’t just a question of meeting your legal obligations.
Ensuring such safeguards protects your organisation financially, reputationally and operationally – because it:
Let’s explore four mechanisms for transferring personal data to a third country under the GDPR, and how they protect your organisation:
Note: Other mechanisms exist, such as derogations for specific situations and compelling legitimate interests, but unlike the four mechanisms listed above, these must be used infrequently and concern a limited number of individuals.
Mechanism #1: AdequacyAdequacy decisions are usually the easiest mechanism for transferring data internationally.
Article 45 of the GDPR grants the European Commission the power to determine that a third country offers an ‘adequate’ level of data protection, based on factors like local legislation and its enforcement.
That means personal data may flow freely between the EU and these ‘adequate’ countries, which are:
You can get an up-to-date list of adequacy decisions on the European Commission website.
Also note that personal data can flow freely between public authorities internationally, subject to “a legally binding and enforceable instrument” (Article 46(2)(a)).
Protecting your organisation with processor contractsWhere you can rely on an adequacy decision, you can’t just start transferring data to that third country: you’ll need a standard Article 28 contract first.
This contract doesn’t just need to meet the requirements of Article 28 by setting out information like:
It must also stipulate that the data processor:
That’s as far as ‘direct’ GDPR requirements go – many of which are clearly also sensible business precautions. You wouldn’t, for example, want to end up in the headlines for a data breach where it turned out you failed to ensure your processor has implemented basic security!
But you can expand your checklist for contracts beyond the GDPR:
Adding non-mandatory items like this can pay dividends to your organisation from a purely business perspective. Plus, while these might not be GDPR requirements, ensuring operational resilience – including in your supply chain – is a legal requirement under, for example, DORA and NIS 2.
Mechanism #2: Standard contractual clausesSCCs (standard contractual clauses) are model contractual clauses, freely available on the European Commission’s website, as provided for by Article 46(2)(c).
Here’s what you need to know:
SCCs work well where the organisations are likely to participate in two-way data sharing, as well as in internal personal data transfers with straightforward processing.
For international organisations, however, SCCs can quickly become cumbersome, as you’d need to use contracts for every pairing of entities. (And potentially different SCCs for different processing activities, too!)
Finding this blog useful? To get notified of future
expert insight like this, subscribe to our free
weekly newsletter: the Security Spotlight.
BCRs (binding corporate rules) under Article 47 are a more convenient option for international organisations.
These are a legally binding set of internal rules that regulate international data transfers within one multinational. They’ll set out details like how you’re applying the data protection principles, how you’re accommodating data subjects’ rights, tasks of the DPO (data protection officer), etc.
Though BCRs cover a much larger and more complex set of processing activities than SCCs, and can therefore be cumbersome to implement, you’ll only need one set of rules, provided that:
For the BCRs to be valid, your supervisory authority must sign them off.
Mechanism #4: CertificationAnother provision, under Article 42, is certification.
We already have Europrivacy, but this certification mechanism currently doesn’t account for international transfers, and can’t be used outside the EU or EEA.
However, Europrivacy is currently being extended to meet the Article 46(2)(f) requirements as an approved mechanism for international transfers under the GDPR.
Once approved by the EDPB, this means organisations could use Europrivacy certification as an approved mechanism for international transfers – but one that offers a far higher level of assurance than the mechanisms discussed above due to the independent verification of the controls in place.
International transfers and DPIAsWhere international transfers are involved, the risks to data subjects are higher.
That means you may need to conduct a DPIA (data protection impact assessment), so you can pin down those risks and implement appropriate measures to mitigate them.
In fact, DPIAs are mandatory under the GDPR for processing activities likely to result in a high risk to data subjects’ rights and freedoms.
Need expert help assessing your data protection risks and selecting appropriate controls?
We first published a version of this blog in January 2020.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.3