The transfer of personal data seems to be ‘hot and happening’ this year. Not only did the European Commission publish the – long awaited – updated Standard Contractual Clauses and was the process towards the adoption of the adequacy decision for the Republic of Korea launched, the UK adequacy decision was also adopted recently.

This blog, however, will delve into the European Data Protection Board’s (“EDPB”) most recent (and adopted) recommendation (18 June 2021): the recommendation on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. In November 2020, we already provided some information on the draft version of this recommendation. This blog will shed some light on the final version and its implications.

Recap

In July 2020, the European Court of Justice (“CJEU”) did not only invalidate the Privacy Shield mechanism, it also took the current Standard Contractual Clauses (“SCCs”) into consideration. Although the CJEU considered the SCCs valid, it did note that the data exporter had to verify, prior to the transfer, whether the level of data protection granted by the GDPR could in fact be respected in the third country in which the receiving party was located. If not, supplementary measures had to be taken where necessary.

This ruling left data exporters and importers with two main questions:

1. How is one to know whether a third country is able to provide a sufficient level of protection?
2. What measures are capable of eliminating possible doubts and dangers?

The EDPB attempted to provide answers to these – valid – questions.

Assessment of practices in a third country (i)

Data exporters should focus not only on the applicable legislation in the receiving country, but also on the practices in that country, as was added to the adopted version of the recommendation. Taking into account the practices is especially relevant if:

• legislation in the third country formally meeting EU standards is manifestly not complied with in practice
• there are practices incompatible with the commitments of the transfer tool where relevant legislation in the third country is lacking
• the transferred data and/or importer fall or might fall within the scope of problematic legislation (i.e. impinging on the transfer tool's contractual guarantee of an essentially equivalent level of protection and not meeting EU standards on fundamental rights, necessity and proportionality)

As follows from the recommendation, if either of the first two situations materialises and no adequate supplementary measures can be taken, transfers should be suspended immediately. The EDPB takes a less strict position as to the third situation: “you may decide to (i) suspend the transfer, (ii) implement supplementary measures to proceed with it or alternatively, (iii) you may decide to proceed with the transfer without implementing supplementary measures if you consider and are able to demonstrate and document that you have no reason to believe that relevant and problematic legislation will be interpreted and/or applied in practice so as to cover your transferred data and importer.

In any case, the assessment should be documented properly and should cover the entire “chain of transfers” e.g. also onward transfers or the engagement of (sub-)processors. The following information could, in addition to general information such as purposes for processing and relevant categories of personal data, for example be included in the assessment:

• Elements on whether public authorities of the third country may seek to access the data with or without the data importer's knowledge, in light of legislation, practice and reported precedents;
• Elements on whether public authorities of the third country may be able to access the data through the data importer or through the telecommunication providers or communication channels in light of legislation, legal powers, technical, financial, and human resources at their disposal and of reported precedents.

Supplementary measures (ii)

Supplementary measures must be assessed on a case-by-case basis. However, according to the EDPB, the assessment does not have to be repeated each time a similar transfer is conducted under similar circumstances. Factors to be taken into account when assessing the suitability are:

• Format of the data to be transferred (e.g. encrypted, pseudonymised or plain text)
• Nature of the data
• Length and complexity of the chain of transfer
• Parameters of practical application of the third country laws

Requirements on the sources of information

The EDPB also provided information on the quality of the sources. Sources of information used for the assessment must meet certain requirements. The sources must be:

• Relevant to the specific transfer and/or importer instead of being overly general
• Objective and supported by empirical evidence and knowledge, not assumptions
• Reliable
• Verifiable as competent authorities must be able to check the information if needed;
• Publicly available or otherwise accessible.

Documented practical experience of the importer with relevant prior instances of requests for access received from public authorities in the third country may also be taken into account. However, the absence of prior instances of requests received by the importer can never be considered, by itself, as a decisive factor on the effectiveness of the transfer tool.

Conclusion

Although the EDPB provided some more guidance on how to carry out transfer assessments, it still leaves us with concerns as to the genuine possibility of lawful transfers, as was the conclusion we reached in our previous blog on this topic. It is understandable that no clear-cut solution can be provided by the supervisory authorities; however, leaving the assessment of both applicable law and suitable supplementary measures to the data exporter (and importers) may be too much to ask.

As to the steps to take, we refer to the table below.