CIPPE Module 7 - International Data Transfers

Question 1

What are the international data transfer options under GDPR?

Answer 1

GDPR has a blanket ban on data transfers outside the EEA except under the following conditions:
a) Adequacy decisions
b) Appropriate safeguards
c) Derogations

Question 2

When international data transfer is involved, what information must controllers provide to DS?

Answer 2

Controllers must also inform data subjects about
a) intent to transfer personal data internationally,
b) presence or absence of adequacy decisions
c) Safeguards

Question 3

What is adequacy?

Answer 3

Adequacy indicates that there is an adequate level of data protection in the country for EU personal data.
The EC makes adequacy decisions - reviewed every four years
EC considers several factors in Adequacy Decisions:
a) Respect for rule of law
b) Access to justice
c) International human rights standards
d) data protection rules

Question 4

What are the steps that the EDPB recommends for data transfers in the sake of Schrems II?

Answer 4

1. Know your transfers - document/map the personal data being transferred
2. Identify your transfer mechanism - is it adequacy or something else (SCC, BCR etc.)?
3. Assess the sufficiency of non-EEA protections
4. Identify and adopt supplementary measures - to close any gaps with the standard of EU data protection laws. (e.g. encryption, psuedonymizations, contracts etc.) - e.g. AWS’s Supplementary Addendum is the enhanced commitment.
5. Take procedural steps to implement supplementary measures - seek authorization of chosen transfer mechanism
6. Revaluate at appropriate intervals.

Question 5

Does UK data protection laws meet EU standards?

Answer 5

Yes.
In 2018, UK passed the data protection act. Consistent with GDPR.
As of Dec 2020, UK has received an adequacy decision with the EU.

Question 6

What are appropriate safeguards?

Answer 6

1. BCRs
2. SCC
3. Approved Code-of-Conduct & Certification
4. Ad hoc contractual clauses
5. Reliance on international agreements

Question 7

What are BCRs?

Answer 7

1. Rules designed to allow multinational companies to adopt a policy suite with rules for handling personal data that are binding on the company.
2. A competent supervisory authority must sign off on those rules.
3. Once approved, company is free to transfer personal data within their org around the world.

Question 8

What are SCC?

Answer 8

1. Model clause approved by the EC; non-negotiable standard form.

You still have to do an equivalence assessment of the laws in the target country.

Question 9

What is a TIA?

Answer 9

TIA = Transfer Impact Assessment
The process of assessing data protection equivalence in a country.

Question 10

What are derogations?

Answer 10

Last resort option to transfer data outside the EEA
Exemption from prohibition
Limited circumstances and very specific conditions
Only to be used when adequacy or appropriate safeguards aren’t valid