International Data Transfer — 9 months after Schrems II
By: Katharina Koerner
Tags: Privacy, Data Protection, Cjeu, Data Transfer, Gdpr

Britt Fuller — Madonna and Child: Migrant Cotton Picker with her baby. Maricopa County, Arizona, 1940

My compatriot Maximilian Schrems has become famous. From Vienna, Austria, his legal activism has shaken up the world of data transfers between the US and the European Union (EU) since 2013, as Lydia de la Torre recounts in her article “Schrems and the future of EU-US data transfers (or lack thereof…)” on Golden Data from July 2020.

On July 16, 2020, the CJEU (Court of Justice of the European Union) declared the European EU-US Privacy Shield, a legal framework to comply with the EU’s data protection requirements, invalid in the so-called “Schrems II”-case. The level of data protection in the US was not considered equal to the protections guaranteed by the EU´s General Data Protection Regulation (GDPR). A similar conclusion was drawn in September 2020 by the Federal Data Protection and Information Commissioner (FDPIC) of Switzerland about the Swiss-US Privacy Shield. Thereby, Privacy Shield followed the path of its predecessor, Safe Harbor, which had been declared invalid in 2015 in the “Schrems I”-ruling. As a result, one could no longer rely on Privacy Shield as a mechanism for data transfers from Europe to the US.

Schrems II one more time withdrew the import of data from Europe to the US of an important legal basis. According to a study by the “Future of Privacy Forum” from last year, more than 5,400 companies had signed up for Privacy Shield since the program’s inception in June 2019. For those companies, it has become crucial to assess alternatives. After all, as the European Data Protection Board (EDPB) had emphasized in its FAQ a week after the judgment, transfers based on the Privacy Shield were declared unlawful by the CJEU without granting any grace period.

It has been nine months since the CJEU´s judgment on Schrems II. I would like to give a short overview of the developments since July of last year in reference to the basic mechanisms of international data transfer. I will conclude with the very recent progress on both sides of the Atlantic.

What has Schrems II changed regarding the transfer of personal data from Europe to the US?

As a general rule, the transfer of personal data for processing outside Europe can take place when certain conditions are met. The protection granted to personal data by the GDPR applies to the European data wherever it goes. The level of protection in third countries does not need to be identical, but essentially equivalent.

The GDPR allows for three general mechanisms as a guarantee that the rights of the individuals are adequately protected: adequacy decisions, appropriate safeguards such as Standard Contractual Clauses (SCCs) by the EC, Binding Corporate Rules (BCR), and derogations.

What are the consequences of Schrems II in regards to these mechanisms?

1. Adequacy decision only invalid from Europe´s perspective

Findings by the European Commission (EC) that the legal framework in a country, territory, sector or international organisation provides “adequate” protection is called an adequacy decision (Article 45 GDPR). Examples are the Privacy Shield and SafeHarbor in regard to the US — by now declared invalid– or decisions by the EC regarding Canada, Israel, Japan, or Argentina. The latest news is the conclusion of EC-adequacy talks with South Korea on March 30, 2021.

Even though the EU-US Privacy Shield Framework is no longer a valid mechanism to comply with EU data protection requirements, the decision does not relieve participants in the EU-US Privacy Shield of their obligations under Framework. The US Department of Commerce continues to administer the Privacy Shield program, including processing submissions for self-certification and re-certification to the Privacy Shield Frameworks and maintaining the Privacy Shield List. The commitment is still enforceable under US law.

If an organization wishes to withdraw from the Privacy Shield, it must contact the Department of Commerce’s International Trade Administration, and fill out a questionnaire to verify what the organization will do with the personal information that it received under the Privacy Shield. It must be indicated if it will retain the data, while the Privacy Shield Principles continue to apply to them, retain it while providing “adequate” protection to it by other authorized means (e.g. by incorporating the standard contractual clauses instead, see below), or delete the data.

2. Appropriate safeguards such as SCC and BCR may need supplementary measures

Article 46 GDPR allows for data transfer under appropriate safeguards. These don´t require any specific authorisation from a supervisory authority. Of all the options, the most commonly used are Standard Contractual Clauses (SCCs) by the EC and Binding Corporate Rules (BCR).

BCR are considered the “Gold standard” for data protection compliance. They are legally binding data protection policies adhered to by an enterprise group established in the EU for transfers of personal data outside the EU. BCR have to be approved by the competent national data protection authority or authorities in the EU (depending on if the group is located in one or more member states) and are then submitted to the EDPB for final approval. Standard Contractual Clauses on the other hand are adopted by the EC and meant to ensure appropriate data protection safeguards for international data transfers. The data exporter and the data importer can include the standard contractual clauses in a wider contract.

Although in Schrems II, the CJEU has basically upheld the validity of the Standard Contractual Clauses, it has pointed out that due to their contractual nature, SCCs cannot bind the public authorities of third countries. The Court stated that it is therefore necessary to verify, on a case-by-case basis, whether the law of the destination of the data transfer ensures an essentially equivalent level of protection, and if not, supplementary measures are needed.

The same is probably true for BCR. While the EDPB stated in its recommendations of November 2020 (see below) that the precise impact of the Schrems II judgment on BCR is still under discussion, it seems clear that if the data is transferred from the EU into a country whose laws make it impossible to fulfill the privacy protection promises made in the BCR, then BCR cannot be used as a basis for the transfer of EU personal data. In these cases, the BCR will also need to be complemented through supplementary measures.

Guidelines of the European Data Protection Board

In light of the findings of the CJEU in Schrems II, and because neither GDPR nor the CJEU defines or specify the “additional safeguards”, “additional measures” or “supplementary measures” to the SCCs and other transfer tools mentioned under Article 46 GDPR, the EDPB adopted recommendations on supplementary measures on November 10, 2020.

These EDPR recommendations define a six-step assessment process for the sufficiency of protections when personal data is sent from Europe:

Map the international data transfers Identify the data transfer mechanism under Chapter V of the GDPR Assessment of legislation in the third country Identify and adopt supplementary measures Take necessary formal procedural steps (e.g. authorization from a supervisory authority) Re-evaluate and monitor at appropriate intervals

Also, the guidelines came forward with a long-awaited clarification of what safeguards (see 4.) companies could in fact implement when foreign protections fall short compared to legal standards in Europe. Supplementary measures are technical, contractual and organisational, and can be found in Annex 2 of the EDPB recommendations.

Technical measures include:

Encryption (in-transit and at-rest with cryptographic keys retained solely by the data exporter, or other entities in Europe or a third country with an adequate level of data protection).

(in-transit and at-rest with cryptographic keys retained solely by the data exporter, or other entities in Europe or a third country with an adequate level of data protection). Pseudonymization (has to happen prior to the transfer; any additional data or algorithm has to be kept separately by the data exporter within Europe or an “adequate” third country).

(has to happen prior to the transfer; any additional data or algorithm has to be kept separately by the data exporter within Europe or an “adequate” third country). Split processing (splitting the data for transfer to two or more independent data importers located in different jurisdictions prior to transmission).

Contractual measures include:

Requirement for the data importer to use specific technical measures .

. Transparency obligations (e.g., reports on access requests by public authorities, information when contractual commitments cannot be met, audit rights).

obligations (e.g., reports on access requests by public authorities, information when contractual commitments cannot be met, audit rights). Obligations to review and challenge disclosure orders of local law enforcement authorities under certain circumstances.

of local law enforcement authorities under certain circumstances. Stipulation that data may only be accessed with consent of the exporter and/or the data subject, and a commitment to assist data subjects in exercising their rights.

Organizational measures include:

Internal governance including standard operating procedures for cases of governmental access requests.

including standard operating procedures for cases of governmental access requests. Documentation of governmental access requests, legal reasoning, and actors involved.

of governmental access requests, legal reasoning, and actors involved. Regular transparency reports concerning governmental access requests.

concerning governmental access requests. Data access and confidentiality policies , strict need-to-know principle, monitoring in form of regular audits with possible disciplinary measures.

, strict need-to-know principle, monitoring in form of regular audits with possible disciplinary measures. Involvement of the data protection officer in all international data transfer matters.

in all international data transfer matters. Adoption of state-of-the-art data security and data privacy policies (e.g., ISO norms) and best practices (e.g., ENISA).

Regular review of internal policies to assess the implemented supplementary measures.

to assess the implemented supplementary measures. Commitment of the data importer not to forward data.

The Annex lists examples of different use cases. The proper and sufficient implementation of additional safeguards depends on the individual circumstances and an assessment has to be done on a case-by-case basis. For cloud services, for example, sufficient additional safeguards are:

strong encryption before transmission, the encryption algorithm and its parameterization (e.g., key length, operating mode, if applicable) conform to the state-of-the-art and can be considered robust against cryptanalysis performed by the public authorities in the recipient country, taking into account the resources and technical capabilities (e.g., computing power for brute-force attacks) available to them, the strength of the encryption takes into account the specific time period during which the confidentiality of the encrypted personal data must be preserved, the encryption algorithm is implemented by a certified software, the encryption keys are reliably managed and the encryption keys are retained solely under the control of the data exporter, or other entities entrusted with this task for which the EC has established that an adequate level of protection is ensured.

In other scenarios, the EDPB states that when unencrypted personal data is necessary for the user service, transport encryption and data-at-rest encryption even taken together will not constitute a supplementary measure that ensures an essentially equivalent level of protection. When no effective supplementary measures can be found, a transfer of personal data outside of Europe may not be conducted.

The same day the EDPB adopted the recommendations on supplementary measures, it issued its recommendations “on the European Essential Guarantees for surveillance measures”. Therein it defined four European Essential Guarantees based on the fundamental rights to privacy and data protection that apply to everyone, irrespective of their nationality:

Processing should be based on clear, precise, and accessible rules

Necessity and proportionality with regard to the legitimate objectives need to be demonstrated

An independent oversight mechanism should exist

Effective remedies need to be available to the individual

These guarantees also have to be taken into account when supplementary measures are adopted.

New Standard Contractual Clauses:

Only two days after the EDPB had published the recommendations on supplementary measures, the EC published its draft for a new version of SCC. An update of SCCs is overdue but was accelerated by Schrems II.

These new SCCs have not yet been adopted but will contain a brand new version for the transfer of personal data to third countries outside of the EU. The latest development was the publication of joint opinions by the EDPB and the European Data Protection Supervisor (EDPS) on SCC in mid-January 2021. Finalizing and publishing of the new SCCs by the EC is expected at any time. If the approved version will match the draft, it will be required to replace all existing SCCs within 12 months of the decision’s adoption.

In any case, the new SCCs will not change the need for an assessment and implementation of supplementary measures if necessary, as the drafts already reference the EDPB recommendations and respectively incorporate some of the supplementary safeguards mentioned by the EDPB.

3. Derogations may be wider applicable

The data transfer can also be covered by an exception according to Article 49 GDPR. These are:

Explicit consent to the transfer

to the transfer Transfer necessary within a contract with the affected person. Or expectation of the contract with the person, and the transfer is necessary to take steps requested by the person

with the affected person. Or expectation of the contract with the person, and the transfer is necessary to take steps requested by the person Transfer necessary within a contract between the controller and another natural or legal person in the interest of the data subject

between the controller and another natural or legal person in the interest of the data subject Transfer necessary for important reasons of public interest

Transfer necessary because of legal claims

Transfer necessary to protect the vital interests of a person when he/she is physically or legally incapable of giving consent

of a person when he/she is physically or legally incapable of giving consent Transfer is made from a register with public interest

Even though Schrems II had no implications for companies that rely on derogations, they could come into play as a possible alternative for a data transfer previously based on the Privacy Shield.

Regarding derogations, the EDPB has generally stated that they are an exemption from the general principle that personal data may only be transferred outside the EU if an adequate level of protection is provided for in the third country or if appropriate safeguards have been adduced. Therefore, relying on them can only be done occasionally and not in the case of repetitive transfers. It is rather necessary to ensure that the transfer is restricted to specific situations, meeting a strict necessity test.

On the other hand, the Future of Privacy Forum reported that relevant voices spearhead a different view. Prof. Dr. von Danwitz, the judge-rapporteur in the Schrems I and Schrems II case, explained at a conference organized by the German Federal Ministry of the Interior in January 2021, celebrating the 40th Data Protection Day, that the CJEU had decided to annul the Privacy Shield with immediate effect because the Court saw no legal void in its absence, but GDPR Article 46 safeguards and Article 49 derogations “cover the absence of an adequacy decision”. He said that derogations could particularly be explored if SCCs are not possible. In his view derogations may not necessarily be interpreted so narrowly as to restrict data transfers, especially within one corporation or group of companies when such data transfer is required and necessary.

This view is also reflected by Paragraph 202 of the CJEU’s Schrems II judgment: “in view of Article 49 of the GDPR, the annulment of an adequacy decision such as the Privacy Shield Decision is not liable to create (…) a legal vacuum. That article details the conditions under which transfers of personal data to third countries may take place in the absence of an adequacy decision under Article 45(3) of the GDPR or appropriate safeguards under Article 46 of the GDPR”.

Recent cases from Europe

National Data Protection Authorities and National Courts in the EU recently came forward with some Schrems II-findings. Here are two of the most recent and relevant:

A decision issued by the Bavarian Data Protection Authority (Bavarian DPA) on March 15, 2021, is the first German enforcement action in connection with Schrems II. It found the transfer of personal data to the US-based email marketing platform Mailchimp to be unlawful. The transfer had been undertaken on the basis of SCCs without assessing whether supplementary measures were necessary. As the publisher had stopped using Mailchimp immediately, the unlawful transfers were incidental, contained no sensitive data, and the nature and gravity of the infringement were minor, the Bavarian DPA did not impose a fine.

In contrast, just a few days earlier, on March 12, 2021, France´s highest court, the Conseil d´Etat, had accepted sufficient safeguards deployed by AWS Sarl, an EU-based subsidiary of Amazon Web Services. The plaintiffs had criticized that hosting sensitive health data by the company located in the EU, but subject to US law, poses high risks of data access requests by US authorities. The Court acknowledged that even though the contract provided that the data must be hosted on EU servers, AWS Sarl, as a subsidiary of a US company, might be subject to access requests by US authorities, and therefore examined the level of protection to personal data under the contract.

AWS Sarl had guaranteed in its contract that it will challenge any general access request from a public authority. It had further declared that the data hosted is encrypted and the key is held by a trusted third party in France, not by AWS. Also, the data is deleted automatically after three months and can be deleted manually by the data subjects themselves at any time. Due to these legal and technical safeguards in place, the Court ruled that the level of protection offered was not insufficient.

Developments in the US

In the US, efforts to fix the issues resulting from Schrems II continue. On March 15, 2021, the EU and US have announced that they will intensify negotiations on an enhanced EU-US Privacy Shield framework that would be compliant with Schrems II.

This came just a few days after the release of a report by the US Congressional Research Service (CRS) of March 17, 2021, assessing the implications of Schrems II for the US and pointing out possible follow-up steps for the US Congress, including:

issuing an executive Presidential order to further limit bulk intelligence collections or provide additional redress mechanisms for individuals, or to establish an executive office or tribunal with the power to adjudicate complaints and issue binding decisions on the intelligence community;

to further limit bulk intelligence collections or provide additional redress mechanisms for individuals, or to establish an executive office or tribunal with the power to adjudicate complaints and issue binding decisions on the intelligence community; seeking diplomatic solutions between the US Department of State and the EC, which could include establishing a new framework to replace Privacy Shield;

between the US Department of State and the EC, which could include establishing a new framework to replace Privacy Shield; the possibility of US Congress adopting statutory requirements to address the CJEU’s concerns in Schrems II, such as by amending the Foreign Intelligence Surveillance Act to prohibit bulk data collections by intelligence agencies; and

to address the CJEU’s concerns in Schrems II, such as by amending the Foreign Intelligence Surveillance Act to prohibit bulk data collections by intelligence agencies; and considering the adoption of a comprehensive federal level data protection law applicable to commercial entities, which would address the EU’s surveillance concerns.

Outlook

With the old framework gone, new rules of data transfer between Europe and US are forthcoming. While the guidelines by the EDPB are well described they yet need to be harmonized with US interests, both in commercial and intelligence space. As new developments are announced almost weekly, the regulatory framework affecting US companies is in a constant state of flux. It is very important to follow new cases as they occur to ensure compliance and avoid hefty fines.