If you are one of the thousands of companies that exports data from the EU to the U.S. or to another third country that lacks an adequacy decision using standard contractual clauses, are you permitted to continue doing so, following the Court of Justice of the European Union’s ruling in the "Schrems II" case? At least to some extent, the answer to this question differs based upon which data protection authority is considered to be your “lead supervisory authority.”
As privacy professionals have spent the past week searching for answers on what to do in the wake of the judgment, several resources have been compiled that aggregate and summarize the statements and guidance put forth by European DPAs. Hogan Lovells put together a useful, color-coded table that analyzes the key messages put out by each DPA and evaluates their stances on the legality of data transfers to the U.S., as well as some other countries, following the ruling. Similarly, OneTrust’s DataGuidance created a concise table that breaks down these statements into comments about Privacy Shield, SCCs and international transfer in general.
The IAPP is also crowdsourcing and curating a "Schrems II" resource page with links to each DPA’s statements and guidance on the ruling that will be updated as more of these resources become available.
Are data transfers to the US that rely on SCCs permitted?
The DPAs that have issued the strictest statements on the unlawfulness of data transfers to the U.S. that rely on SCCs include the German DPAs in Berlin and Hamburg, as well as the Dutch data protection authority, the Autoriteit Persoonsgegevens. These authorities are advising data controllers not to transfer such data to the U.S. In lieu of continuing these transfers, the Berlin commissioner advised EU data controllers sending data to the U.S. to begin to use service providers based in the EU or another third country with an adequate level of protection.
In addition, multiple DPAs issued statements suggesting it is risky to rely on SCCs to transfer data to the U.S. Germany’s Federal Commissioner for Data Protection and Freedom of Information (BfDI), for example, said that data transfers to the U.S. relying on SCCs require “appropriate safeguards” and that the burden of implementing the CJEU’s decision falls at least in part on individual companies. The Estonian Data Protection Inspectorate similarly noted that EU companies transferring data to any third country with an insufficient level of protection must assess whether Europeans’ data can be protected and that, if “the protection of personal data cannot be guaranteed, the transfer of data must be suspended.” The DPA in Rhineland-Palatinate stressed the lack of a grace period and audit obligations of companies and proposed a multi-step assessment process companies should use to determine whether their transfers are legal. Essentially, if a company is using SCCs to transfer data to a telecommunication company in the U.S. or send unencrypted data over a trans-Atlantic cable and no alternative transfer instruments, in accordance with Chapter V or Article 49 of the EU General Data Protection Regulation, apply, then these data transfers “are no longer possible.” Similarly, the DPA in Thuringia was skeptical as to whether SCCs can be “brought to life” and deemed it “unlikely” that SCCs can still be used to legally transfer data to the U.S. Also in this camp was Ireland's Data Protection Commission, which stated that “the application of the SCCs transfer mechanism to transfers of personal data to the United States is now questionable” and that such assessments “will need to be made on a case by case basis.”
Lastly, multiple DPAs issued statements that emphasized that the ruling “validated” the use of SCCs as a transfer mechanism. These include the UK’s Information Commissioner's Office, which expressed its readiness to work “to ensure that global data flows can continue,” Denmark’s Datatilsynet, which said SCCs are “generally still valid,” the European Data Protection Board, France’s Commission nationale de l'informatique et des libertés, Poland’s Urząd Ochrony Danych Osobowych, Romania’s National Supervisory Authority for Personal Data Processing, Slovenia’s Information Commissioner, Spain's Agencia Española de Protección de Datos, Lithuania’s State Data Protection Inspectorate, and Switzerland’s Federal Data Protection and Information Commissioner (which noted, however, that the ruling is not directly applicable to it).
What are DPAs still investigating?
One thing that is all but certain is that DPAs are now preparing to provide more guidance in the coming days, weeks and months. In their statements responding to the ruling, multiple data protection authorities — including those in Ireland, Denmark, Switzerland, Lithuania, Liechtenstein, France, the Netherlands, Norway and the EDPB — pointed to several issues that they need to investigate further. One such issue is the basic question of what “additional measures” could allow the SCCs to provide an essentially equivalent level of protection as EU law. Germany’s BfDI also said it would publish additional statements on the European Commission’s plans to revise the current SCCs and the need for the U.S. to protect the fundamental rights of Europeans. Germany’s Rhineland-Palatinate DPA has also said it will examine the implications of the ruling for binding corporate rules.
The externalities of 'Schrems II': Fragmentation in the GDPR’s application across the EU
One of the unintended consequences of the CJEU "Schrems II" ruling may be that it further fragments the application of the GDPR along national lines based on DPAs’ interpretations, guidance and enforcement standards. In the commission’s recent assessment of the GDPR’s application following its two-year anniversary, for example, it found that “a truly common European data protection culture between data protection authorities is still an on-going process.” While the commission’s findings on fragmentation in GDPR implementation focused on sector-specific, national legislation and “extensive use of facultative specification clauses,” differing levels of strictness of DPAs in their enforcement actions around data transfers will further frustrate efforts at harmonization and could contribute to a “race to the bottom,” whereby firms relocate to jurisdictions known to take a laxer approach to enforcement.
The problem of fragmentation is not new but has undoubtedly taken on a new dimension given what is now at stake in trans-Atlantic data transfers. As a piece in the National Law Review explained, “the ball is now with the individual DPAs to decide on a case-by-case basis whether the SCCs may still be used.” In the coming days and weeks, we can certainly expect more guidance on SCCs and other aspects of the CJEU’s ruling from DPAs, each of which has received countless requests from industry for clarification about what the ruling means in practice. But whether this creates a more harmonized interpretation of how SCCs can be used or more fragmentation in their application remains to be seen.
Conclusion
The guidance issued by DPAs in the hours and days following the CJEU’s ruling in the "Schrems II" case provided much-desired clarity amid a decision that upended the legal certainty surrounding the Privacy Shield and SCCs as data transfer mechanisms that companies had relied on for many years. While it was not entirely unforeseen that Privacy Shield would meet the same fate as its predecessor, Safe Harbor, what the ruling said about SCCs has proved harder to unpack.
DPAs across the continent have offered strikingly disparate assessments of what the ruling means for EU-U.S. data transfers that rely on SCCs. While several DPAs — notably in Berlin, Hamburg and the Netherlands — seemed to have declared them to be mostly invalid and advised companies to cease such transfers and/or switch to local providers, others, such as those in the U.K., France and Spain, seemed to have not explicitly deemed them invalid. Another group of DPAs, which includes Ireland’s DPC and Germany’s BfDI, have taken what could be described as an intermediary position between these two points, advising companies that they may continue to rely on SCCs but must heed the risks inherent in the mechanism and undertake additional assessments to determine if these transfer are lawful.
As DPAs issue more guidance in the coming days and weeks, whether the EU develops greater harmonization in its approach to SCCs or continues to diverge along national lines will have important consequences for the future of data flows, digital economy and nature of privacy protection around the world.
Photo by Kyle Glenn on Unsplash
