If you are one of the thousands of companies that exports data from the EU to the U.S. or to another third country that lacks an adequacy decision using standard contractual clauses, are you permitted to continue doing so, following the Court of Justice of the European Unionâ€™s ruling in the “Schrems II” case? At least to some extent, the answer to this question differs based upon which data protection authority is considered to be your â€œlead supervisory authority.â€�
As privacy professionals have spent the past week searching for answers on what to do in the wake of the judgment, several resources have been compiled that aggregate and summarize the statements and guidance put forth by European DPAs. Hogan Lovells put together a useful, color-coded table that analyzes the key messages put out by each DPA and evaluates their stances on the legality of data transfers to the U.S., as well as some other countries, following the ruling. Similarly, OneTrustâ€™s DataGuidance created a concise table that breaks down these statements into comments about Privacy Shield, SCCs and international transfer in general.
The IAPP is also crowdsourcing and curating a “Schrems II” resource page with links to each DPAâ€™s statements and guidance on the ruling that will be updated as more of these resources become available.
Are data transfers to the US that rely on SCCs permitted?
The DPAs that have issued the strictest statements on the unlawfulness of data transfers to the U.S. that rely on SCCs include the German DPAs in Berlin and Hamburg, as well as the Dutch data protection authority, the Autoriteit Persoonsgegevens. These authorities are advising data controllers not to transfer such data to the U.S. In lieu of continuing these transfers, the Berlin commissioner advised EU data controllers sending data to the U.S. to begin to use service providers based in the EU or another third country with an adequate level of protection.
In addition, multiple DPAs issued statements suggesting it is risky to rely on SCCs to transfer data to the U.S. Germanyâ€™s Federal Commissioner for Data Protection and Freedom of Information (BfDI), for example, said that data transfers to the U.S. relying on SCCs require â€œappropriate safeguardsâ€� and that the burden of implementing the CJEUâ€™s decision falls at least in part on individual companies. The Estonian Data Protection Inspectorate similarly noted that EU companies transferring data to any third country with an insufficient level of protection must assess whether Europeansâ€™ data can be protected and that, if â€œthe protection of personal data cannot be guaranteed, the transfer of data must be suspended.â€� The DPA in Rhineland-Palatinate stressed the lack of a grace period and audit obligations of companies and proposed a multi-step assessment process companies should use to determine whether their transfers are legal. Essentially, if a company is using SCCs to transfer data to a telecommunication company in the U.S. or send unencrypted data over a trans-Atlantic cable and no alternative transfer instruments, in accordance with Chapter V or Article 49 of the EU General Data Protection Regulation, apply, then these data transfers â€œare no longer possible.â€� Similarly, the DPA in Thuringia was skeptical as to whether SCCs can be â€œbrought to lifeâ€� and deemed it â€œunlikelyâ€� that SCCs can still be used to legally transfer data to the U.S. Also in this camp was Ireland’s Data Protection Commission, which stated that â€œthe application of the SCCs transfer mechanism to transfers of personal data to the United States is now questionableâ€� and that such assessments â€œwill need to be made on a case by case basis.â€�
Lastly, multiple DPAs issued statements that emphasized that the ruling â€œvalidatedâ€� the use of SCCs as a transfer mechanism. These include the UKâ€™s Information Commissioner’s Office, which expressed its readiness to work â€œto ensure that global data flows can continue,â€� Denmarkâ€™s Datatilsynet, which said SCCs are â€œgenerally still valid,â€� the European Data Protection Board, Franceâ€™s Commission nationale de l’informatique et des libertÃ©s, Polandâ€™s UrzÄ…d Ochrony Danych Osobowych, Romaniaâ€™s National Supervisory Authority for Personal Data Processing, Sloveniaâ€™s Information Commissioner, Spain’s Agencia EspaÃ±ola de ProtecciÃ³n de Datos, Lithuaniaâ€™s State Data Protection Inspectorate, and Switzerlandâ€™s Federal Data Protection and Information Commissioner (which noted, however, that the ruling is not directly applicable to it).
What are DPAs still investigating?
One thing that is all but certain is that DPAs are now preparing to provide more guidance in the coming days, weeks and months. In their statements responding to the ruling, multiple data protection authorities â€” including those in Ireland, Denmark, Switzerland, Lithuania, Liechtenstein, France, the Netherlands, Norway and the EDPB â€” pointed to several issues that they need to investigate further. One such issue is the basic question of what â€œadditional measuresâ€� could allow the SCCs to provide an essentially equivalent level of protection as EU law. Germanyâ€™s BfDI also said it would publish additional statements on the European Commissionâ€™s plans to revise the current SCCs and the need for the U.S. to protect the fundamental rights of Europeans. Germanyâ€™s Rhineland-Palatinate DPA has also said it will examine the implications of the ruling for binding corporate rules.
The externalities of ‘Schrems II’: Fragmentation in the GDPRâ€™s application across the EU
One of the unintended consequences of the CJEU “Schrems II” ruling may be that it further fragments the application of the GDPR along national lines based on DPAsâ€™ interpretations, guidance and enforcement standards. In the commissionâ€™s recent assessment of the GDPRâ€™s application following its two-year anniversary, for example, it found that â€œa truly common European data protection culture between data protection authorities is still an on-going process.â€� While the commissionâ€™s findings on fragmentation in GDPR implementation focused on sector-specific, national legislation and â€œextensive use of facultative specification clauses,â€� differing levels of strictness of DPAs in their enforcement actions around data transfers will further frustrate efforts at harmonization and could contribute to a â€œrace to the bottom,â€� whereby firms relocate to jurisdictions known to take a laxer approach to enforcement.
The problem of fragmentation is not new but has undoubtedly taken on a new dimension given what is now at stake in trans-Atlantic data transfers. As a piece in the National Law Review explained, â€œthe ball is now with the individual DPAs to decide on a case-by-case basis whether the SCCs may still be used.â€� In the coming days and weeks, we can certainly expect more guidance on SCCs and other aspects of the CJEUâ€™s ruling from DPAs, each of which has received countless requests from industry for clarification about what the ruling means in practice. But whether this creates a more harmonized interpretation of how SCCs can be used or more fragmentation in their application remains to be seen.
The guidance issued by DPAs in the hours and days following the CJEUâ€™s ruling in the “Schrems II” case provided much-desired clarity amid a decision that upended the legal certainty surrounding the Privacy Shield and SCCs as data transfer mechanisms that companies had relied on for many years. While it was not entirely unforeseen that Privacy Shield would meet the same fate as its predecessor, Safe Harbor, what the ruling said about SCCs has proved harder to unpack.
DPAs across the continent have offered strikingly disparate assessments of what the ruling means for EU-U.S. data transfers that rely on SCCs. While several DPAs â€” notably in Berlin, Hamburg and the Netherlands â€” seemed to have declared them to be mostly invalid and advised companies to cease such transfers and/or switch to local providers, others, such as those in the U.K., France and Spain, seemed to have not explicitly deemed them invalid. Another group of DPAs, which includes Irelandâ€™s DPC and Germanyâ€™s BfDI, have taken what could be described as an intermediary position between these two points, advising companies that they may continue to rely on SCCs but must heed the risks inherent in the mechanism and undertake additional assessments to determine if these transfer are lawful.
As DPAs issue more guidance in the coming days and weeks, whether the EU develops greater harmonization in its approach to SCCs or continues to diverge along national lines will have important consequences for the future of data flows, digital economy and nature of privacy protection around the world.
Photo by Kyle Glenn on Unsplash