Source: https://iapp.org/news/a/schrems-redux-now-what/
Timestamp: 2019-04-19 08:21:57+00:00

Document:
According to the forthcoming 2017 IAPP-EY Privacy Governance Survey, to be released at P.S.R. in San Diego, 88 percent of companies that transfer personal data from the European Union to the United States and other non-"adequate" countries rely on standard contractual clauses as a valid method for doing so.
So, what happens now? What does the CJEU referral mean procedurally under the EU legal system, and how does it relate to the GDPR’s adoption into law of SCCs as a valid data transfer mechanism? Finally, what should privacy professionals be doing right now to ensure legal compliance while they await more certainty on SCCs?
A reference for a preliminary ruling is a mechanism of EU law that allows national member states’ courts to refer questions on certain matters to the CJEU, whose decisions are binding for all member states’ national courts. This ensures uniform application and interpretation of EU law and provides legal certainty. Pursuant to Article 19 (3) (b) of the Treaty on European Union and Article 267 of the Treaty on the Functioning of the European Union, the CJEU has jurisdiction to provide preliminary rulings on the interpretation of the EU law and validity of acts adopted by EU institutions, bodies, offices or agencies.
The scope of the CJEU’s role in a preliminary ruling is to interpret EU law or rule on the validity of an EU Act, “not to apply that law to the factual situation underlying the main proceedings … [which] is the task of the national court or tribunal.” The CJEU is expected to give a reply that will provide guidance in resolving the dispute in the main proceedings, such that the referring court will draw specific conclusions from that reply.
Regarding the hierarchy of the sources of the EU laws, a Directive or Regulation is a type of secondary legislation, which is “valid only if it is consistent with the acts and agreements which have precedence over it,” such as treaties and charters.
Yet, with the Oct. 3 decision of Justice Costello to formulate and refer question to the CJEU for a preliminary ruling on the validity of SCCs, pending submissions from the parties to the proceedings as to the content of those questions, their future role in data transfers under the GDPR will, at least for a while, remain uncertain. Indeed, it may not be until after May 2018, when the GDPR is set to come into force, that a determination is made as to whether SCCs remain a valid mechanism for EU-U.S. data transfers.
While awaiting the CJEU’s decision on the adequacy of SCCs, it will be important to remember other mechanisms to legitimize personal data transfers out of the EU, such as the Privacy Shield, as well as those under the Data Protection Directive and forthcoming GDPR.
The Privacy Shield, a framework for transferring personal data from the EU to the U.S., replaced the invalidated Safe Harbor agreement and offers a voluntary mechanism for organizations to self-certify that they are complying with the requirements. According to the forthcoming 2017 Privacy Governance Report, 47 percent of respondents use Privacy Shield as a valid data transfer mechanism, up from just 34 percent in the 2016 report.
Yet, concerns over the Privacy Shield have persisted, particularly in the areas of automated decision-making, the right to object and its applicability to data processors, and U.S. public authorities' access to Europeans’ data. The Privacy Shield is now under challenge in European Courts by the Irish privacy advocacy group Digital Rights Ireland, which is seeking the annulment of the Commission’s decision on the Privacy Shield for failing to comply with the EU’s Charter and provide an adequate level of protection. While the destiny of the Privacy Shield remains uncertain, the Commission “is convinced that the Privacy Shield will live up to the requirements set out by the European Court of Justice which has been the basis for the negotiations.” Upcoming developments in the Privacy Shield are important to watch not only to understand how reliable it will be for data transfers, but also whether it will reflect expectations around the updated mechanisms.
The GDPR recognizes the Directive’s prohibition on data transfers outside of the EU (and the EEA) to countries without adequate levels of data protection, but it also provides more details and specific guidance on ways for organizations to implement these safeguards.
The GDPR introduces new assessment mechanisms by periodically reviewing adequacy. Considering developments in the third country, this review is to be conducted at least once every four years. If the Commission finds that a third country (or “a territory or a specified sector within a third country, or an international organization”) no longer provides an adequate level of data protection, then the transfer “should be prohibited” unless other requirements are fulfilled, such as appropriate safeguards, binding corporate rules, and derogations. The Commission can repeal, amend, or suspend the decision by implementing acts without retroactive effects.
In the absence of an adequacy decision, a data controller or processor can also transfer personal data to a third country or organization if they have provided “appropriate safeguards.” Transfers that are subject to appropriate safeguards include “a legally binding and enforceable instrument between public authorities or bodies,” binding corporate rules, standard data protection clauses adopted by the Commission, standard data protection clauses adopted by a supervisory authority and approved by the Commission, approved codes of conduct, and certification mechanisms.). In addition, the GDPR also recognizes derogations for specific situations.
Even though they are not explicitly stated in the Directive, BCRs are another mechanism to use for data transfers, with just over 100 companies that have been through the process to obtain them. They can be described as “internal rules (such as a Code of Conduct)” about international data transfers “within the same corporate group to entities located in countries which do not provide an adequate level of protection.” BCRs are used to ensure that data transfers within the group benefit from an adequate level of protection.
Under the GDPR, competent DPAs shall approve the BCRs and specify the structure and rules that organizations have to comply with in detail. Some of these include specifying the structure of the group of undertakings, the types of processing and its purposes, and the categories of personal data involved in data processing.
As the IAPP-EY Annual Privacy Governance Report 2016 found, however, BCRs are primarily used by large organizations, with only 8 percent of small companies (organizations that have fewer than 5,000 employees) considering them appropriate for data transfers.
DPAs have the authority and advisory power in issuing opinions and draft codes of conduct. Associations and other bodies representing certain categories of data controllers and processors can prepare, amend, or extend codes of conducts under the conditions in compliance with the GDPR. A separate body, which demonstrates independence and expertise in the subject matter, establishes procedures and structures to handle complaints regarding the infringements of the codes of conduct and proves that there is no conflict of interest, can apply to monitor the compliance and periodically review the operation of the code of conducts. This body is also authorized to take appropriate action in the case of noncompliance, such as suspending or excluding the authority from the code and informing the relevant DPA. DPAs can “publish the criteria for accreditation of a body for monitoring codes of conduct and of a certification body” or revoke the accreditation of a body.
Another new mechanism the GDPR recognizes is that certifications, data transfers seals and marks may allow cross-border data transfers if they “demonstrat[e] the existence of appropriate safeguards provided by controllers or processors” in line with the GDPR’s requirements. Certifications can be issued by certification bodies, DPAs, or by the European Data Protection Board and businesses can apply for certification or seals by providing “all information and access to its processing activities” to DPAs, the certification body.
This certification body must demonstrate their independence and expertise, subject to approval by the DPA; establish procedures to conduct periodic reviews, withdrawal of certification, seals, and marks; have a mechanism in place to deal with complaints; and show no conflict of interest. These certification bodies shall monitor and assess the certification scheme and withdraw if they fail to fulfill the requirements. The important thing is that these certification mechanisms will be issued for “a maximum period of three years” and may be renewed or withdrawn if requirements are no longer met.
A transfer to a third country or an international organization may take place only if the transfer is not repetitive, concerns only a limited a number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data.
When these conditions are met, the data controllers shall inform the DPAs on the transfer.
Moreover, some of the recital provisions offer additional guidance as to the reliance on derogations. For instance, data transfers based on a compelling legitimate interest require consideration of the nature of the data, purpose and duration of the processing operations, country of origin, destination, and other considerations, such as use in scientific and historical research, statistical purposes, and the legitimate expectations of society.
In its decision to make a reference to the CJEU for a preliminary ruling on the validity of SCCs, the Irish High Court reiterated that the legal issues involved are “vitally important” and “of very major, indeed fundamental, concern to millions of people within the European Union and beyond,” and which require “consistency and clarity” from Europe’s highest court. The interpretation and scope of analysis provided by the CJEU on these issues, as well as Commission’s response throughout the process, may decide the future of SCCs under the GDPR.
In line with these recent legal developments affecting the EU-U.S. data transfers, including the invalidation of Safe Harbor and recent challenges to the validity of SCCs and the Privacy Shield, providing a meaningful, “essentially equivalent” mechanism to meet the EU’s expectations to ensure privacy and data protection in data transfers should be a priority. Providing a more robust redress mechanism, creating opportunities for data subjects to be involved in the process, and increasing transparency should be at the forefront of the discussions around cross-border data transfers. Not only does the forthcoming GDPR impose higher sanctions for noncompliance, legal developments demonstrate that ensuring data protection and privacy under the EU data protection framework significantly affects an organization’s practices and data flows across the Atlantic and elsewhere around the world.
library_books After Schrems, After Paris: What Next?

References: CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU