GDPR Cross-border Transfers: Draft SCCs and Supplementary Measures

Following the drama of the Schrems II decision, the EDPB has issued new draft SCC’s and some guidance on supplementary measures for Non-EU data transfers. But will they work?

Key take-aways

• If you’ve relied on Standard Contractual Clauses (SCCs) to cover transfers of personal data from the EU, they will need to be updated;
• There’s no solution yet for transfers to countries like the US, which might include Australia (whether relying on SCCs, Binding Corporate Rules or other approved transfer mechanisms);
• There’s an expectation that you will be pro-active in assessing jurisdictions where data may be transferred and identifying appropriate supplemental measures if required;
• You will also need to continuously monitor any supplemental measures implemented to ensure they remain adequate;
• You must keep evidence of these efforts as part of your accountability obligations;
• However, it may be that there are no supplemental measures sufficient to provide essential equivalency in which case, data transfers may need to be suspended.

Background

In July 2020, the Court of Justice of the European Union (the “CJEU”) caused a stir when it invalidated the Privacy Shield mechanism for transfer of personal data from the EU to the US. Known as the Schrems II decision, the CJEU’s judgment (conditionally) also upheld the Standard Contractual Clauses (“SCCs”) as a valid mechanism for transfers of personal data to jurisdictions outside the EU.

However, the CJEU also ruled that controllers relying on SCCS for their data transfers outside the EEA are required to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data in the third country, if the law of the third country ensures a level of protection for the personal data transferred that is essentially equivalent to that guaranteed in the EEA.

The CJEU ruling allows data exporters to add measures that are supplementary to the SCCs to ensure effective compliance with that level of protection where the safeguards contained in SCCs are not sufficient.

New draft Standard Contractual Clauses (SCCs)

The current SCCs have been om the table for updating for some time, having been approved pre-introduction of the GDPR. The  draft new SCCs seek to upgrade the previously approved clauses to bring them in line with the GDPR. They will also cover different types of transfers, in order to cater for “the complexity of modern processing chains”.   For the first time, the SCCs will be available not just for controller to controller or controller to processor transfers, but also for the transfer of data from processor to  processor (or processor to sub-processor).

The clauses have also been updated post-Schrems II and now contemplate introduction of specific safeguards, in light of the Schrems II case.

Once finalised, there will be a new set of SCCs and all organisations relying on SCCs for transfers of personal data will have to update the contractual terms they are relying on.

The final version of the new SCCs can be expected in early 2021, after which there will be a transition period of one year to allow for the roll out of the new contracts. During this transition period, the old SCCs will remain valid in existing contracts, so long as the parties to the contracts do not change them. However, the new SCCs will have to be used immediately (once approved) for any new data processing agreements and in most cases where introducing changes to existing contracts.

Clarifications

The new draft SCCs include some clarifications. Most importantly they confirm that accessing personal data from a third country will be regarded as a transfer.  This could cover, for example:

• Outsourced customer service providers in a non-EU country who access data from the EU located CRM to provide service to customers,
• Accessing data from a cloud storage provider in a non-EU country.

Essentially Equivalent Laws

Whilst the increased flexibility of the new draft SCCs is welcomed, the Schrems II decision made it clear that the SCCs cannot be used without considering the laws of the countries where the data is being transferred.  In Schrems II, the CJEU emphasized that before using the SCCs, parties must review the laws of the destination country (and in particular the powers of local security agencies) and consider reinforcing the SCCs with additional safeguards (or supplementary measures).

The biggest issue post Schrems II is trying to identify which country’s laws may be regarded as offering ‘essentially equivalent’ protection to that provided under the GDPR, and what that might mean.

The draft guidance makes it clear that the EDPB expects organisations to assess the laws of the data importer’s country and any impediment to compliance with transfer obligations. In particular, data exporters will have to:

• verify if data subjects rights in the context of international transfers (such as access, correction and deletion requests for transferred data) can be effectively exercised in practice and are not thwarted by law in the third country of destination; and
• verify the presence of any relevant laws, which may require disclosure of personal data to public authorities or give public authorities powers of access, and then verify that any such requirements or powers:
  • are limited to what is necessary and proportionate in a democratic society; and
  • may not impinge on the commitments contained in the transfer tool the exporter is relying on.

The Recommendations also state that Section 702 of the U.S. FISA “does not respect the minimum safeguards resulting from the principle of proportionality under EU law and cannot be regarded as limited to what is strictly necessary,” meaning that where data importers or any recipients of onward transfers are subject to Section 702 of FISA, additional supplementary technical measures will be required in addition to SCCs or other recognised transfer mechanisms.

Supplementary measures

If the laws of the transferee country are not ‘essentially equivalent’, then supplementary measures may need to be implemented (in addition to the contractual protections in the SCCs). The purpose of these supplementary measures is to elevate the protection afforded to data in the local country so that it rises to the appropriate level of protection under the EU standards.

Not only do supplementary measures need to be identified, those measures also needs to be properly documented to comply with the GDPR’s accountability principle.  The supplementary measures at issue may be contractual, technical, and organisational.

The EDPB provides a non-exhaustive list of suggested supplementary measures, including:

• Technical measures: such as forms of encryption, however encryption keys must be kept beyond the reach of relevant public authorities. Another technique may be  seudonymization where that does not permit re-identification of data (i.e. by using key-coding or applying other pseudonymisation techniques, where the key is not accessible to authorities).
• Additional contractual measures: such as obligations to implement the technical measures discussed above, transparency obligations regarding the level of access available to government authorities in the recipient jurisdiction and the measures taken to prevent access to personal data, and reinforced power for the data exporter to conduct audits of the data importer. Non-EU transferees may also be required to review the legality of any access requests received by them and to challenge such requests where appropriate.
• Organizational measures: such as adoption of internal policies with clear allocation of responsibilities for data transfers and operating procedures in the event of an access request, transparency and accountability measures including documentation of access requests, and ensuring data minimization.

You may need to combine several measures to ensure the appropriate level of protection. encryption as a technical measure where the recipient in the third country is exposed only to encrypted data.

If you find that no additional measures can ensure an essentially equivalent level of data protection, you may not transfer personal data to that third country.

What do you need to do?

These recent changes have resulted in significant repercussions for organisations transferring GDPR governed data to a third country outside of the EU. This includes transfers to the US, Australia, and (after the 31^stof December 2020) most likely the UK.

If you have not already done so, now is the time to consider the steps below (taken from the European Data Protection Board (EDPB) draft guidance in supplementary measures to the SCCs) to help ensure your continued GDPR compliance.

European Essential Guarantees for Surveillance Measures

In addition, the EDPB published draft recommendations on the European Essential Guarantees for surveillance measures (the “EEG Recommendations”), which complement the draft SCCs and Supplementary Measures Recommendations.   These Recommendations aim to provide guidance on the elements to examine whether surveillance measures allowing access to personal data by either national security agencies or law enforcement authorities in a third country can be regarded as a justifiable interference or not.

We will cover this in more detail in a subsequent post.  However, the following may be a useful resource if you are trying to assess the surveillance laws of a third country.

European Essential Guarantees Guide – A Global Look at Fundamental Rights to Privacy & Data Protection

Conclusion

We expect that supervisory authorities will continue to develop guidance around this topic to ensure consistency in the application and enforcement of the GDPR.

But ultimately organisation transferring data subject to the EU GDPR restrictions are responsible for making the concrete assessment in the context of the transfer, the third country law and the transfer tool they are relying on. If you are covered, you must proceed with due diligence and document the process followed thoroughly, as you will be held accountable for the decisions made under the principle of accountability set out in the GDPR.

The EDPB also recognises that it may not be possible to implement sufficient supplementary measures in every case.

Given there are no “one size fits all’ solutions for third country transfers, we recommend that you urgently assess your EU to non-EU data transfers on a case by case basis and consider whether any further steps should be taken.

Further Resources:

Analysis of Schrems II Judgement

EDPB FAQ on Schrems II

Draft Standard Contractual Clauses

Recommendations on Supplementary Measures

European Essential Guarantees Guide – A Global Look at Fundamental Rights to Privacy & Data Protection