The Court of Justice of the European Union has invalidated the Privacy Shield the EU and USA agreement regarding the transfer of personal data updated in 2016. Also, additional criteria were set forth for data transfer, based on Standard Data Protection Contractual Clauses (SCC). This means that from now on many companies will be facing more difficulties when transferring personal data to countries outside the EU.
Transferring the personal data of European citizens outside of the EU is prohibited by the General Data Protection Regulation (GDPR), unless proper security of the data is ensured.
The companies that transfer the personal data of their clients or employees to data processors or controllers to third parties located outside the EU, e.g., providers of data storage (cloud) services or payroll services, must first ensure that the transferred personal data will be properly protected and secured. These companies have to conclude data processing agreements and also choose one of the suitable methods of transferring personal data as set forth in the GDPR.
The following are several ways of ensuring proper personal data security:
No additional measures are required when transferring data to an approved country which ensures an adequate level of protection; thus, this is one of the most convenient ways to transfer personal data to a third country. Based on this principle, personal data transfers were permitted to commercial data recipients (controllers or processors)in the US that followed the Privacy Shield provisions, until the decision of the Court of Justice of the European Union (CJEU) in case No. C‑311/18. However, the CJEU determined that the Privacy Shield was not sufficient to protect the personal data of the European citizens from the US Government and did not grant the proper rights to defend oneself from possible spying.
SCC are yet another method of personal data transfer and they are signed with the data recipient in a third country. According to the CJEU, when signing such clauses, data controller should also take the possible data access of governmental institutions of the respective third country into account. This is why the CJEU made personal data transfer to the USA more difficult for the majority of companies, as according to the US laws, companies are obligated to grant governmental institutions access to the personal data of both the US and third country citizens.
Companies which use SCC for personal data transfers to third countries must assess whether or not the governmental institutions of the respective countries may demand access to a disproportionate quantity of the protected personal data of the European citizens. If such a possibility exists, the personal data cannot be transferred under this basis.
For example, in Lithuania, upon the request of governmental institutions, providers of electronic communication services (Internet and mobile connection) must grant these institutions access to the electronic communication data, if such access is required to investigate severe or grave crimes. Meanwhile, in the USA, such access is granted to both the communication data of the suspected individual and any other individuals who comply with monitoring program criteria, although are not necessarily suspected of any crime.
Without a doubt, the requirement to assess the laws of third country and to inform the other contractual party about any changes in such laws bring many difficulties to the companies. The European Commission has notified that in consideration of the CJEU decision, the approved SCC are under review and will be soon updated. Maybe, a list of the approved countries or sectors will be prepared.
The companies which used the Privacy Shield to transfer personal data to the US should now choose other possible measures to ensure personal data protection.
Associate of Glimstedt Law Firm Raminta Bučiūtė specializes in data protection, intellectual property and technology, media and communication law
