Sharing personal data with EU companies may become more complicated

It may seem at first glance that the ruling does not affect other countries - but this is not quite true. The cancellation of the Privacy Shield Agreement was still another reason for the Europeans to think about whether the arrangements for transfers of the personal data of EU citizens to third countries are safe in principle. The algorithm currently in effect for such cross-border transfers is the one prescribed by the European General Data Protection Regulation (GDPR). It can be described as follows:

Unless the European Commission has decided that the level of protection ensured to personal data in the country concerned is adequate, data transfers are only possible where so-called appropriate safeguards are in place; the list of such safeguards can be found in Article 46 of the GDPR. The Regulation subdivides such safeguards into two groups: group one safeguards allow cross-border transfers of data without having to obtain a permission from the EU supervisory authorities, while group two safeguards trigger the requirement to obtain such a permission. The first group of appropriate safeguards includes: 

2. The second group of safeguards includes:

The SCC and the BCR are the most frequent arrangements for most market players.

The EU data protection authorities and the Court of Justice of the EU stated in the afore-mentioned ruling in the Schrems case that these mechanisms are still in effect - and they are currently in fact the principal way to organise legitimate transfers of personal data from the European Union. However, according to some experts, the existence of SCC in a contractual relationship does not give full assurance to the parties to a cross-border transfer. The reason is that it is now the responsibility of the data controller in the EU to make sure that the state importing personal data ensures an adequate data protection level. If the controller concludes that adequate protection is impossible to ensure in the third country concerned, they will not be allowed to transfer data across the border to the foreign processor. But even where the parties believe that the conditions required for data transfers are fulfilled, European controlling authorities may decide otherwise during the audit and cancel the SCC. Moreover, some experts believe that SCC are actually obsolete as the basis for cross-border data transfers and are likely to be reviewed soon.

As far as the BCR are concerned, this mechanism is only applicable to a narrow range of entities and therefore it is not suitable for most market players. In addition, European regulators do not believe that the BCR are able to ensure protection of personal data in third countries in all situations. For example, in case national authorities of the importing country request access to personal data, the processor may not refuse them referring to the existence of the valid BCR.

Thus, neither the SCC nor the BCR are able currently to ensure that the data transfer subjects will be free from possible claims from EU authorities.

From the perspective of business circles, the most popular situation from this list is the personal data subject’s consent to the cross-border transfer. According to the GDPR requirements, this consent must be informed and explicit. At the same time, the controller is obliged to inform the personal data subject of the possible risks of such transfers.

Data transfers on the basis of the data subject’s consent are currently the safest option in terms of possible public authority interventions. However, even the data subject’s consent does not rule out exposure to risks of audits. The regulators may have questions as to whether the consent was sufficiently informed and if the data subject was aware of all possible consequences of data transfers to a third country. Furthermore, it is highly probable that European authorities will limit the possibility of using this reason for data transfers in near future in order to prevent its systematic use by market players.

The foregoing shows that the data transfer mechanisms currently in place need to be improved and the general situation remains uncertain. The European Data Protection Board (EDPB), which has promised to issue proper explanations, is expected to clarify the issues raised. The scheduled date of their release is not yet known, but it is likely that they will only be released after some months.

In this regard, Russian companies are particularly interested in the algorithm of actions required in the existing situation. Based on the data available to date, we recommend that the following be done: