Robert Bond (robert.bond@bristows.com) is Senior Counsel & Notary Public at Bristows LLP in London, UK.
On June 18, 2021, the European Data Protection Board (EDPB) published updated guidance on the Court of Justice of the European Union’s Schrems II decision.[1] Its guiding principle is that any personal data transferred must be provided with an “essentially equivalent” level of protection, and the controller or processor transferring the data should ensure this essential equivalence is achieved.
The six-step process
The guidance sets out a six-step process for relying on the standard contractual clauses (SCCs) and, in Annex 2, provides examples of “supplementary measures” that could be implemented. Note that, in order to meet the General Data Protection Regulation (GDPR) accountability requirements, each of these steps would need to be documented, and this documentation must be provided to the supervisory authorities on request.
-
Know your transfers: Understand what data you are transferring outside the European Economic Area, including by way of remote access.
-
Identify your transfer tool(s): Identify what lawful mechanism you are relying on under GDPR to transfer the data.
-
Assess whether the transfer mechanism is effective in practice: This requires exporters to consider whether anything in the local law potentially thwarts the protection supposedly offered by the SCCs. The EDPB recommends considering multiple aspects of the third country’s legal system but in particular the rules granting public authorities rights of access to data. Most countries allow for some form of access for law enforcement and national security, so the assessment should focus on whether those laws are limited to what is necessary and proportionate in a democratic society.
-
Adopt supplementary measures: If your assessment of the local law at Step 3 is that SCCs alone would not be sufficient, then you must adopt supplementary measures to protect the data. The EDPB separates potential supplementary measures into three categories: technical, contractual, or organizational.
-
Procedural steps if you identified any supplementary measures: This step is only applicable if your supplementary measures contradict the SCCs (hopefully they won’t), so it seems a bit of a red herring.
-
Reevaluate at appropriate intervals: Monitor developments in the recipient country that could affect your initial assessment. The obligations on the data importer under the SCCs should help here, as it is required to inform the data exporter of a change of law that affects its ability to comply with the SCCs.
