Module 7: International Data Transfers Flashcards
What is an adequacy decision?
An adequacy decision permits a cross-border data transfer outside the EU, or onward transfer from or to a party outside the EU without further authorisation from a national supervisory authority (Article 45(1), GDPR).
Who has the power to enforce an adequacy decision?
The European Commission has the power to determine whether a third country has an adequate level of data protection.
What is the criteria for an adequacy decision?
respect of the rule of law
access to justice
international human rights standards, general and sectoral laws and case laws
effective and enforceable rights for individuals
data protection rules and professional rules
security measures and other international commitments or obligations
Example of countries with adequacy decisions in place with the EU
New Zealand, Andorra, Canada, Japan
What was the EU - US Privacy Shield (now invalidated)?
An invalidated adequacy decision.
Applied to organisations under FTC enforcement and acted as voluntary self certification programs, through commitment, publicity, public disclosure, implementation and renewal.
What were the 7 principles of privacy shield?
The seven privacy shield principles included: Notice Choice Accountability for onward transfer Security Data integrity and purpose limitation Access Recourse, enforcement and liability
Additional Privacy Shield provisions included an annual joint review and limited, proportionate surveillance.
What are appropriate safeguards?
Standard data protection clauses and approved codes of conduct and certification mechanisms.
Includes ad hoc contractual clauses, and international agreements.
What are codes of conduct and what do they do?
Codes of conduct are created or revised by regulators and associations and other bodies representing controllers or processors for GDPR application, helping controllers and processors to demonstrate compliance, creating marketing efficiencies and facilitating international data transfers.
They are binding and enforceable.
What are certification mechanisms and what do they do?
Certification mechanisms may be issued by accredited certification bodies, competent supervisory authorities or the EDPB for assisting controllers and processors in same situations as through codes of conduct and by additionally demonstrating compliance with Article 25 (data protection by design and by default)
These are good for no more than 3 years, but may be renewed. There are consequences for non-compliance.
What are binding corporate rules and what do they do?
Apply to companies engaged in joint economic activity, corporate groups and groups of enterprises, and controllers/processors
Are internal and legally binding rules that expressly confer enforceable rights of data subjects
Are actioned through standard applications, with approval by supervisory authorities and detailed conditions for transfers (outlined in Article 47)
Are used to give flexibility and due to low administrative burden post implementation
What are the derogations relating to international data. transfers?
Derogations regarding international data transfers under Article 49 of the GDPR include: Consent Performance of contract Public interest Establishment, exercising or defense of legal claims Vital interests Transfer from register Legitimate interests
What are the restrictions of international data transfers?
Foreign law enforcement requests
Important reasons of public interest
