EU cross-border transfers of personal data are highly regulated. Existing restrictions are designed to ensure that the level of protection of personal data is not undermined by exporting data. A heavy compliance burden is imposed on U.S. entities that import EU personal data because the U.S. regulatory data protection framework differs from the EU framework in ways that, from an EU perspective, undermine the effective protection of EU data if exported. That compliance burden does not exist for entities exporting data into a territory that is deemed adequate from an EU standpoint. The EU General Data Protection Regulation creates a new possibility that may enable the state of California to avoid the restrictions that would normally accompany a cross-border transfer of data.
The GDPR prohibits data transfer of personal data to non-EU countries or to international organizations unless the European Commission has made the determination that the country, organization or territory receiving the data ensures an adequate level of protection or the controller or processor have provided appropriate safeguards for the transfer (GDPR, Article 44.) The 1995 Data Protection Directive also prohibited transfers to non-EU countries unless an adequate level of protection was in place and empowered the European Commission to make adequacy determinations while leaving to the discretion of member states the mechanisms for ensuring an adequate level of protection (Directive Article 25, 31). Several exceptions to the general prohibition (derogations) for specific situations exist, but they are to be narrowly interpreted (GDPR Article 49 and Recitals 111 to 113, and Directive Article 26).
The GDPR specifically refers to the possibility of a “territory” or “one or more specific sectors” obtaining an adequacy decision (GDPR Article 45.1). Although this possibility was not explicitly included in the Directive, it is hardly new. Out of the 12 adequacy determinations by the European Commission so far, four were granted to territories of EU Members or Crown Dependencies (the Faroe Islands, an autonomous country within the Kingdom of Denmark), Guernsey, Isle of Man and Jersey, which are Crown Dependencies), and one was granted on a specific compliance framework (Privacy Shield). That said, we have never seen a non-EU territory seek and obtain an adequacy decision. GDPR clearly opens this door.
A U.S. state, for example California, could take advantage of this possibility and obtain adequacy determination from the European Commission even though the U.S. as a whole does not have an adequacy determination (the EU-U.S. Privacy Shield Framework provides a method for organizations to transfer data from the EU to the United States but only covers those entities that self-certify and remain compliant with the framework). A California adequacy decision could allow California-based organizations to transfer data from the EU without a need to be Privacy Shield certified, or use other appropriate safeguards (such as standard contractual clauses, or binding corporate rules).
The GDPR does not list the requirements for the European Commission to grant an adequacy determination but provides a list of factors to be considered (Article 45.2). These include: the respect for human rights and the rule of law, relevant data protection legislation in both the public and private sector, including rules for onward transfer from the country seeking adequacy to another third country, enforceable data subject rights, judicial redress, and other international agreements of the third country, particularly in relation to data protection.
In order to qualify for adequacy, California would need to:
- Enact comprehensive data protection legislation and abandon a sectoral approach to data protection. California has been very proactive in enacting data protection regulations and currently has multiple state laws on topics ranging from health data to identity theft and unsolicited commercial communications (a full list of all California data protection laws is available at the State of California Justice Department.
- Identify a governmental agency that can serve as a data protection authority or create it. Such agency would be tasked with enforcing California’s data protection laws, assisting EU residents seeking to enforce their rights under the GDPR against California based entities and cooperating with the data protection authorities in the EU. There have been steps taken in this direction. Specifically, in February 2018, California Assemblymember Marc Levine, D-Marin County, introduced AB-2128, which would create the California Data Protection Authority. The final scope of the tasks to be performed by the agency is still unknown, as the proposal has undergone changes, and additional modifications are likely before approval. However, the bill demonstrates the political will to undertake data protection reform at the state level and, in fact, the Mercury News quotes Assemblyman Levin who believes “California has a role to play and can be a model for federal law.”
Benefits of an adequacy decision for California companies include not having to apply for Privacy Shield and submit themselves to FTC oversight or rely on onerous standard contractual clauses. There have been legal challenges in the European Courts to both EU-U.S. Privacy Shield and standard contractual clauses. If either of these transfer mechanisms was invalidated, an adequate California would not automatically be affected by the decision and could continue to transfer data.
If California was granted adequacy, its status would be periodically reviewed by the European Commission at least every four years, as is the case with all adequacy decisions. An adequacy review by the Commission would take into account “all relevant developments in the third country” and would force California to monitor implementation of their data protection scheme or risk losing the adequacy determination. The European Commission has never revoked an adequacy decision; however, there has been speculation that some countries may lose their adequacy status in a review after GDPR comes into effect.
In addition to the challenges of amending the substantive law, there may also be limits in the U.S. Constitution that prohibit California’s ability to regulate data protection in a comprehensive way. As this is an area regulated at the federal level, a California general data protection law could potentially be found unconstitutional or pre-empted by existing federal regulations. In 2005, the Federal Court of the Appeals for the 9th Circuit found that California’s Financial Information Privacy Act (CalFIPA), which limited sharing of personal information by financial institutions, was pre-empted by the federal Fair Credit Reporting Act. A subsequent ruling in 2009 revived portions of the California law, but only with respect to the restrictions not already covered by federal law.
It is not clear whether California has the political will to move from a sectoral data protection framework to a comprehensive one. Even if the will existed at the state level, federal level restrictions could stand in the way of accomplishing this goal. However, it is a possibility worth exploring given the potential benefits of eliminating EU data transfer restrictions for California-based entities.
Photo credit: Thomas Hawk via photopin