In its “Schrems II” opinion issued July 16, the Court of Justice of the European Union did not reach any findings on the EU Commission's decisions 2001/497/EC or 2004/915/EC, i.e., the standard contractual clauses for the transfer of personal data to controllers. However, the rationale behind the CJEU’s ruling on the controller-to-processor SCCs, as well as on the EU-U.S. Privacy Shield, suggests two things with respect to controller-to-controller SCCs:
- The additional measures for transfers under C2P SCCs also apply to transfers under C2C SCCs.
- Those additional measures for C2C transfers may be even more burdensome than those for C2P transfers because the level of protection afforded to data subjects under C2C SCCs seems to be lower than under C2P SCCs.
Companies will, therefore, need to evaluate each data flow under C2C SCCs, in particular with respect to the legal system of the third country, types of data transferred, type of recipient and types of data subjects. This is because “Schrems II” was not limited to data transfers to the U.S. but applicable to all data transfers to third countries outside of the EU/European Economic Area.
C2C SCCs are still valid
To be clear, at this time, C2C SCCs remain valid because “Schrems II” did not address them. As set out below, however, a risk exists that the CJEU may subsequently invalidate C2C SCCs if asked to weigh in on the question, taking into account its reasoning in “Schrems II.”
Additional conditions for data transfers under C2C SCCs
Considering the CJEU’s reasoning in “Schrems II,” it also seems unavoidable to apply the additional conditions for transfers under C2P SCCs to transfers under C2C SCCs. While Articles 46(1) and (2)(c) of the EU General Data Protection Regulation were analyzed by the CJEU only for C2P SCCs, they represent the same legal basis for transfers under C2C SCCs. Article 46(1) of the GDPR, moreover, specifically says that data transfers to a third country may only occur on the condition that data subjects have enforceable rights and legal remedies.
“In the absence of a decision pursuant to Article 45(3) [i.e. an adequacy decision by the EU Commission], a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.”
In light of the"Schrems II" decision, we must focus on two important requirements for cross-border data transfers that rely on SCCs: (1) appropriate safeguards; and (2) data subjects having enforceable rights and effective legal remedies available. This applies not only for future cross-border data transfers, but also to already ongoing data transfers. To determine whether data subjects have enforceable rights and effective legal remedies available, however, the CJEU now requires an assessment of the legal system of the third country and whether the data subjects are afforded a level of data protection essentially equivalent to the level of protection under the GDPR and the EU Charter of Fundamental Rights.
Assessment of the level of data protection in the third country
As covered in our guidance controller-to-processor SCCs, the CJEU did not specify what aspects must be considered in this assessment or address how companies will be able to carry out this complex assessment that requires a detailed understanding of the legal system of a third country. While we are all waiting for guidance from the authorities on how this assessment should be performed (ideally even guidance on the key aspects of the third countries’ legal system), the assessment could generally include:
- Carefully read the C2C SCCs and work with the importer to ensure that they are able to address all of the provisions of those clauses.
- Carry out due diligence on the type of data transferred, type of data subjects, processing purpose, retention period, and type of recipient/industry sector of the recipient.
- Carry out due diligence of the legal system in the third country to which personal data is exported to verify the rules for disclosure to and access by governmental agencies which includes, for example, whether and to what extent the third-country legal system authorizes government agencies to require disclosure of data and whether data subjects (including foreign data subjects) are informed about the disclosure and are able to bring legal remedies in court or tribunal.
- Carry out due diligence with the importer to determine whether the importer is bound by these laws, including the likelihood that the importer will disclose personal data of the exporter to the authorities in that third country, which could take into account, for example, the industry involved, categories and volume of personal data transferred, purposes of the processing by the importer, duration of data retention in the third country, etcetera.
- Carry out due diligence on the data importer to verify that the importer has a procedure to notify the data exporter, in compliance with the SCCs if a government demand extends to the data exporter’s data and will provide an opportunity to resist production.
- Confirm, on the basis of the due diligence carried out, that the C2C SCCs, in conjunction with any other applicable contractual terms for the relationship, are sufficient to address any issues raised as to the protection of personal data in the third country in that context or whether the circumstances require more specific terms as additional measures of protection.
- Put in place additional measures of protection if necessary to cure any deficiencies identified in the due diligence, for example, regarding the limitations of notification obligations in Clause II (b) of the C2C SCCs.
- Document such due diligence and the rationale for determining adequacy to have on file something akin to a data protection impact assessment for each set of transfers in case its position is ever challenged.
As data exporters located in the EU are much more likely to be subject to enforcement actions by the EU data protection authorities than a data importer outside of the EU, data exporters should take on this assessment as their own responsibility and accountability. Enforcement actions, in particular, an order of suspensions or fines, will in most cases be imposed on the EU data exporter, not a foreign-based data importer.
C2C SCC as appropriate safeguards
When comparing C2P SCCs against C2C SCCs, one could argue that C2C SCCs offer data subjects less protection than C2P SCCs. This is because C2P SCCs are governed by the law of the EU member state in which the data exporter is located and the further processing of the personal data by the processor importer remains subject to the GDPR, as the controller remains responsible for compliance of the processing with GDPR. The C2C SCCs, on the other hand, say only that data was transferred in compliance with the GDPR, but any further processing by the data importer is in principle no longer subject to GDPR. Under C2C SCC, the parties can freely decide whether the further processing shall be subject to GDPR or “only” to the processing principles set out in Annex A. Furthermore, under the C2C SCC, the notification requirements vis-a-vis the data exporter for disclosing data to third parties do not apply to disclosures to persons permitted or authorized by law to have access to the personal data.
This suggests that a data importer under C2C SCC would not be required to inform the data exporter about a governmental disclosure request.
In light of the varying protection levels under C2C and C2P SCCs, companies should consider the protection levels under C2C SCCs when carrying out the supplemental assessment of the legal system of the third country. As part of that assessment, it may be necessary to undertake an additional arrangement between the parties to cover the gap between C2P and C2C SCCs. And, in so doing, remember that the CJEU may in a future opportunity hold them as invalid within the meaning of Article 46 (2)(c) of the GDPR.
Photo by Helloquence on Unsplash
