Seminar 18+19 - International data transfers

Question 1

Relevant provisions?

Answer 1

●	GDPR Chapter V
●	GDPR Art. 44
●	GDPR Art. 45
●	GDPR Art. 46
●	GDPR Art. 49
●	GDPR Art. 50

Question 2

Is there a definition of int. data transfers in GDPR?

Answer 2

No.

Question 3

Name examples of Int. data transfers?

Answer 3

Computer brought to third country w. personal data, transfers via international company’s intranet, uploading on a cloud-solution, employee searching on data base from third country, data made public on non-EU webpage.

Question 4

Name examples of non-Int. data transfers?

Answer 4

Transmission through third countries (passing through e-mail), if controller is established in another MS and data is processed in DK. Publication of information on webpages if EU-server.

Question 5

Why do we need rules for international data transfers?

Answer 5

Purpose is to ensure that the data subjects rights are safeguarded when data are transferred outside the EU

Question 6

Name the 3 different ways there are to transfer data to third countries?

Answer 6

1. On the basis of an adequacy decision (art. 45),
2. by ensuring appropriate safeguards (art. 46) hereunder binding corporate rules (art. 47) or
3. with one of the derogations listed in art. 49.

Question 7

What is an Adequacy decision?

Answer 7

A transfer to a third country or international organization may take place, where the Commission has decided that the third country ensures an adequate level of protection.

Question 8

What is Appropriate safeguards?

Answer 8

In the absence of an adequate decision, transfers can be allowed if the controller or processor provides appropriate safeguards and enforceable rights, and if effective legal remedies are available to data subjects.

For example: contractual clauses or binding corporate rules.

Question 9

What is Derogations for specific situations?

Answer 9

Personal data transfers to a third country may be justified, even in the absence of an adequate decision or safeguards, in one of the listed circumstances in art. 49(1)(a)-(f), e.g. explicit consent, necessary for performance contract or public interest

Question 10

What if a transfer cannot be based on a provision in art. 45, art. 46 (incl. art. 47) or art. 49(1)(a)-(g)?

Answer 10

The transfer may then only take place only if:
■ the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and has suitable safeguards
■ The controller shall inform the SA of the transfer

Question 11

Name a relevant case with regards to definition of Int. data transfer?

Answer 11

The Lindqvist case suggests that data transfer should be an active act, which involves sending data, and not just making it passively accessible, however, this does not mean that granting access may not also constitute a transfer (judgement is based on specific factors, as the website was not intended to be read outside Sweden).

Question 12

What does the Schrems case illustrate?

Answer 12

Illustrates how data protection rights under EU law can apply to data processing in third countries.

Question 13

Why do we have derogations from restrictions on international data transfers?

Answer 13

Derogations are meant to cover situations in which there is no adequate protection in the country to which the data are to be transferred, but ‘the risks to the data subject are relatively small’ or ‘other interests override the data subject’s right to privacy’

Question 14

Give an example of a derogation?

Answer 14

o Example:

 Transfer reasons of health data abroad for treatment – as that would trumpf the the persons health.

Question 15

Name an example of adequate safeguards?

Answer 15

Contractual clauses or corporate rules.

Question 16

What was the main holding in the Schrems case?

Answer 16

The CJEU went on to note that the European Commission did not state in its Safe Harbour decision that the US ensures an adequate level of protection (paragraph 97), and that the decision was accordingly invalid, without there being any need for it to examine the substance of the Safe Harbour principles

Question 17

What implies an Adequacy decision?

Answer 17

Protection that is “essentially equivalent” but not necessarily “identical” to that under EU law.

Question 18

Name an example of adequacy decision?

Answer 18

Safe Harbour was an example.

Question 19

What is an International Data Transfer?

Answer 19

• 3rd party that isn’t part of the EU or EEA – transfer of data.
• No definition of data transfers in the GDPR
• ‘Communication, disclosure or otherwise making available of personal data, conducted with the knowledge or intention of a sender subject to the Regulation that the recipient(s) will have access to it’

Question 20

What is the structure for the exam with an international data transfer?

Answer 20

• General prohibition of data transfers outside the EEA, unless
  o Adequacy Decisions
   When adequacy decisions are not available,
  o Appropriate safeguards:
   Standard Contractual Clauses (SSCs)
   Binding Corporate Rules (BCRs)
   Approved Codes of conduct and certification mechanisms together with binding enforceable commitments
   “Ad hoc” SCCs When adequacy decisions or appropriate safeguards are not available:
  o Consent Performance of a contract Public Interest Controller’s legitimate interest (with limitations)

Question 21

Why do we have derogations from restrictions on international data transfers?

Answer 21

• Ratio: derogations meant to cover situations in which there is no adequate protection in the country to which the data are to be transferred, but ‘the risks to the data subject are relatively small’ or ‘other interests override the data subject’s right to privacy’ (WP29 1998)

Question 22

Give a concrete example of derogations from restrictions on international data transfers?

Answer 22

 Transfer reasons of health data abroad for treatment – as that would trumpf the the persons health.

Question 23

The role of the DPA?

Answer 23

DPAs are independent public authorities that supervise, through investigative and corrective powers, the application of the data protection law