On Nov. 18, the European Data Protection Board adopted draft guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the EU General Data Protection Regulation. The draft guidelines are open to public consultation until the end of January.

GDPR regulates transfers of data: But what is a transfer?

Chapter V of the GDPR sets out rules for the transfer of personal data to third countries or international organizations. However, the GDPR does not contain a definition of "transfer." The EDPB proposes three cumulative criteria for transfers:

1. A controller or a processor is subject to the GDPR for the relevant act of processing.
2. This controller or processor ("exporter") discloses that personal data by transmitting it, or otherwise making it available, to another controller, joint controller or processor ("importer").
3. The importer is in a third country or is an international organization. This is true whether or not the GDPR is also applicable to the processing of personal data by the importer.

Deflating the "GDPR bubble"

Organizations with U.K. operations may be familiar with the concept of the "GDPR (now, U.K. GDPR) bubble." The U.K. Information Commissioner's Office suggests that if the U.K. GDPR is applicable to an organization on an extraterritorial basis, then transfers of personal data to that organization are not "restricted transfers" – even though the organizations are physically outside the U.K., they are still within the bubble of the U.K. GDPR.

The EDPB deflates the GDPR bubble. It points out that in this situation, there is still a risk that "the protection provided by the GDPR is undermined by other legislation the importer falls under. This may for example be the case where the third country has rules on government access to personal data that go beyond what is necessary and proportionate in a democratic society…" (paragraph 3). Accordingly, a disclosure of personal data to an importer, to whom the GDPR is applicable on an extraterritorial basis, should still be regarded as a data transfer. Further disclosures of personal data, by that importer, to other controllers or processors in third countries would also amount to transfers — and need to meet the conditions in Chapter V of the GDPR.

How to provide appropriate safeguards when transferring personal data to an importer directly subject to the GDPR?

Many organizations need to transfer personal data to controllers or processors in third countries when there is no adequacy decision, and no derogation is applicable to the transfer. These organizations should use a "transfer tool" set out in Article 46 GDPR. The main data transfer tool is the use of standard contractual clauses. The EDPB notes that in this scenario, this would mean using a transfer tool "currently ... only available in theory." This is because Article 1 of Commission Implementing Decision 2021/914 (i.e., the decision adopting new SCCs) states the clauses provide appropriate protection for the transfer of personal data to a controller or (sub-)processor whose processing of data is not subject to GDPR. The EDPB notes it is ready to cooperate in the development of transfer tools that can be used in this situation. It also emphasizes these tools should avoid duplicating GDPR obligations that would already be applicable to the importer and instead should aim to address concerns relating to conflicting national laws and/or government access rights in the third country. 

Direct disclosures by a data subject to an overseas controller or processor – no transfer 

The draft guidelines state that where data subjects disclose data directly, on their own initiative, to a controller or processor in a third country, this is not a "transfer." This is because a transfer has to be made by one controller or processor to another controller or processor. If a data subject makes the data available, this is not the case. The draft guidelines use the example of a consumer in Italy ordering goods online from a retailer's website in Singapore.

It takes two to tango – and to effect a transfer

The draft guidelines also state the concept of transfer only applies to disclosures between two different, separate parties, each of whom is a controller, joint controller or processor: the importer must be different from the exporter. The EDPB gives the example of an employee of a Polish company who travels to India for a meeting and accesses company systems remotely while in India. The draft guidelines note the employee is not another controller but an integral part of the controller, so this is not a transfer.  

The draft guidelines note disclosures of personal data between members of a corporate group often will amount to transfers because there would be separate controllers – for example, in the case of subsidiary and parent company. The draft guidelines do not discuss branches – which do not have separate legal personalities. However, following the logic described above, it would seem that a disclosure of data by a branch to a head office may not amount to a "transfer."

When something does not qualify as a transfer to a third country, but still involves sharing of personal data overseas, the EDPB emphasizes — as the processing may still be associated with risks due to conflicting laws or government access — the controller must remain accountable for its processing and must comply with its other obligations under the GDPR.

The draft guidelines note the EDPB is willing to collaborate on transfer tools for use with organizations to whom the GDPR applies under Article 3(2). Article3(2) applies the GDPR on an extraterritorial basis when personal data is processed by a controller or processor not established in the EU when it is apparent that the controller or processor intends to offer goods or services to data subjects in the EU, or monitors the behavior of data subjects in the EU. 

What about Article 3(1) and extraterritorial reach?

However, Article 3(2) is not the only way the GDPR can have an extraterritorial effect. The GDPR can also apply on an extraterritorial basis to processing by a controller or processor outside the EU, which processes personal data in the context of the activities of an establishment in the EU under Article3(1). This is the principle established by the Court of Justice in the European Union ruling in Google Spain. The EDPB also reiterates this in its guidelines 3_2018 on territorial scope and uses the following example.

"An e-commerce website is operated by a company based in China. The personal data processing activities of the company are exclusively carried out in China. The Chinese company has established a European office in Berlin in order to lead and implement commercial prospection and marketing campaigns towards EU markets. In this case, it can be considered that the activities of the European office in Berlin are inextricably linked to the processing of personal data carried out by the Chinese e-commerce website, insofar as the commercial prospection and marketing campaign towards EU markets notably serve to make the service offered by the e-commerce website profitable. The processing of personal data by the Chinese company in relation to EU sales is indeed inextricably linked to the activities of the European office in Berlin relating to commercial prospection and marketing campaign towards EU market. The processing of personal data by the Chinese company in connection with EU sales can therefore be considered as carried out in the context of the activities of the European office, as an establishment in the Union. This processing activity by the Chinese company will therefore be subject to the provisions of the GDPR as per its Article 3(1)."

Let's change the facts slightly so that the Berlin office also carries out some processing and that personal data is then transferred to China. Let's also say the Berlin office is a subsidiary of the Chinese parent company. Following the EDPB's three criteria, this would be a transfer of personal data. However, GDPR would be applicable to the processing by the Chinese parent company pursuant to Article 3(1), meaning the SCCs cannot be used. Both the EDPB, in the draft guidelines, and the European Commission at the IAPP Data Protection Congress 2021, mention working on transfer tools to address transfers to organizations to whom the GDPR is applicable pursuant to Article 3(2). To paraphrase Oscar Wilde, "To lose one form of extraterritorial application of GDPR may be regarded as a misfortune; to lose both looks like carelessness." Let's hope these tools also address the extraterritorial impact of Article 3(1) on the importer; otherwise, data exporters will still be left with a transfer for which only theoretical solutions are available. Let's also hope that these new tools address both Articles 3(1) and 3(2) in the same instrument: it would be very complex to have three different sets of SCCs. 

Photo by Kelly Sikkema on Unsplash