A look at data transfers under different data protection regulations

Organizations are subject to different regulations to protect personal data that they communicate to overseas recipients for various reasons, including the development of business operations, business relationships or the availability of service providers in third countries.

With the EU General Data Protection Regulation, organizations can make international personal data transfer decisions, in the absence of an adequate level decision pursuant to Article 45, using binding corporate rules, standard contractual clauses approved by the European Commission, and contractual clauses authorized from each supervisory authority in concrete cases (Article 46), among other mechanisms.

Those legal instruments allow data exporters established in the EU to ensure adequate safeguards with respect to the protection of personal data transferred to recipients established in third countries not recognized as having an adequate level of data protection by the EC (Article 45).

Under data protection (or data privacy) frameworks of non-EU countries, such as Canada, Australia or Singapore, organizations can transfer personal data to overseas recipients under the accountability principle, not based on the concept of adequacy, but rather, on the basis of the concept of comparable level of protection.

For example, the Privacy Amendment Act 2012 of Australia permits cross-border disclosure of information while ensuring that personal information is still treated in accordance with the Privacy Amendment Act (Principle 8).

International personal data transfers based on an accountability principle require organizations to take reasonable steps to ensure that the overseas recipient processes the personal data transferred in accordance with the regulatory requirements of the exporting country and individuals' rights provisions, e.g., entering into a legally enforceable agreement between the parties, including a sub-processing clause, if applicable, without needing to obtain prior authorization from the supervisory authority.

In the matter PIPEDA Case Summary No. 2008-394, the Office of the Privacy Commissioner of Canada analyzed some issues surrounding foreign outsourcing. In this case, the OPC highlighted: “The Assistant Commissioner was satisfied that CanWest maintains custody and control of the information that is processed by its third-party service provider in the U.S. The service agreement between the two parties relies on unambiguous language that provides guarantees of the confidentiality and security of personal information, and it allows for oversight, monitoring and audit of the services being provided. The contractual provisions with regard to information protection are no less stringent than they would be if the service provider were located within Canadian borders ... The Assistant Commissioner emphasizes the importance of organizations assessing the risks that could jeopardize the security and confidentiality of customer personal information when it is transferred to foreign-based third-party service providers. It is essential that organizations using third-party service providers outside Canada use contractual or other means to provide a comparable level of protection while the information is being processed by the third party.”

International personal data transfers based on an accountability principle does not mean that the supervisory authority cannot investigate complaints or audit the personal information handling practices of exporters regarding cross-border data flows.

For example, look to the Office of the Privacy Commissioner for Personal Data of Hong Kong's approach: “When a complaint is received, the Commissioner will consider all the means engaged by a data user to protect personal data transferred to offshore entities to determine whether it has ‘taken all reasonable precautions and exercised all due diligence´ to ensure that the personal data will be handled in the same manner as required by the Ordinance.” 

Article 37 of the Cybersecurity Law of the People’s Republic of China establishes that critical information infrastructure operators need to obtain a security assessment from the national internet information authority together with relevant departments of the State Council in order to transfer personal data outside mainland China. It must be established whether it is truly necessary for business requirements.

In many contexts, the regulatory divergence among countries creates legal uncertainty for organizations regarding the transfer of personal data outside of each country’s borders.

For instance, a multinational group of undertakings can make many international transfers of personal data to organizations within the same corporate group outside the EU in the context of EU BCRs, without additional requirements.

On the other hand, when that same multinational group of undertakings transfers personal data from Australia to organizations within the same corporate group inside the EU, they must adopt contractual or other means under Australia's Privacy Amendment Act, regardless of those EU BCRs.

Accordingly, to reduce that compliance burden, expand business opportunities and increase efficiency in global commerce, it is extremely important that the supervisory authorities find global solutions that facilitate both the free flow of personal data and the data protection compliance without generating unnecessary inequalities in the market.

Two solutions must be pointed out in this regard. 

The first solution is that the supervisory authorities do not request additional requirements where an organization is subject to binding obligations (or codes of conduct in more traditional terminology), such as EU BCRs or APEC Cross-Border Privacy Rules.

The second solution is that the organizations adopt an international standard contract, subject (or not) to the approval from each national supervisory authority, finding for spaces of convergence and commonalities between all regulations, which include the following clauses, but are not limited to:

Part I: Standard clauses

• An assessment that determines the necessity of the transfer of personal data and the transfer of personal data is not prohibited or restricted by the laws and regulations.
• A general description of the transfer covered by the contract, including the purposes of the transfer/processing, the duration of the transfer/processing, the purposes of the onward transfer, the type, volume and scope of the transfer, the categories of individuals, the contact details of the data importer and the data exporter, the country of origin of the data and the country of final destination of such data.
• The overseas recipient ensures compliance with the requirements of law in relation to the collection, use, disclosure, storage and deletion of personal data, that be carried out by it on behalf of the data exporter.
• The overseas recipient has policies and processes in place, including training for its staff. The overseas recipient guarantees the individuals' rights (e.g. access, update, rectification, deletion, among others).
• The overseas recipient assists the data exporter to respond to requests for exercising the data subject's rights.
• The overseas recipient does not engage another recipient without prior specific or general written authorization of the data exporter, including a “multi-layered” sub processing clause.
• The overseas recipient implements a personal data breach (or data privacy breach) response plan which includes a mechanism for notifying the data exporter on data breaches.
• The overseas recipient provides administrative, technical and physical protections to safeguard against, inter alia, unauthorized usage, modification, copying, accessing or other unauthorized processing of personal data transferred.
• The overseas recipient deletes or returns all personal data when it is no longer needed or at the end of the contract.
• The overseas recipient compensates damage resulting from the violation of the contract or the regulations.
• The procedure to be followed to ensure that obligations imposed by the contract are met, including the exercise the right to audit when warranted.
• An indication that the personal data transferred can be accessed by national authorities within data importer’s jurisdiction, if applicable. This would help the data exporter inform the individuals that their data can be accessed by the foreign authorities while it is being processed by the third party.
• Where it is an intra-group transfer, overseas recipient is expected to have implemented adequate internal safeguards and policies as well as procedures which apply to the group as a whole.

 Part II: Supplemental clauses

• The supplemental clauses required by all the original source country legislation, if applicable.
• The parties can insert additional clauses according to their business needs and/ or commercial arrangements.

It important to stress that an international standard agreement to transfer personal data would allow international supervisory authorities to carry out investigations on cross-border transfers under a standardized and uniform manner, particularly against those foreign companies conducting business in a global context, such as airlines, banks, pharmaceutical companies, etc.

In that respect, in the matter Sony PlayStation Network, the Office of the Australian Information Commissioner stressed that: “While the incident did not constitute a breach of the Act, during the course of the investigation the Privacy Commissioner obtained information on the interrelationship of the various Sony entities involved in this matter. This information demonstrated the potential challenges for agencies regulating the flow of personal information where large global companies undertake different functions relating to the provision of services and products, including the collection of personal information, while operating out of different jurisdictions.”

Finally, each supervisory authority must decide how to allow the transfers of personal data outside its borders, either through BCRs approved from any EU supervisory authority or the international standard contract agreed between the parties, without the need to request any further requirements.

Nevertheless, it is important to reiterate again that an international standard contract is, in practice, able to deploy real and ensured legal effects; in particular, as regards the effective protection of personal data by the parties after the international transfer, there should not be any reason to exclude such a possibility by international supervisory authorities. 

photo credit: GWP Virtual Network Meeting 2015 via photopin