Schrems II – A few Things to Keep in Mind! | McAfee Blogs

A couple of days ago, I have been asked whether, notably thanks to the GDPR[1] and the CCPA[2], we were seeing as professionals, a standardization in negotiations governing privacy terms.

Alas, we have possibly never been so much away of such harmonization. 128 out of 194 countries have put in place legislation to secure the protection of data and privacy. And despite the existence of initiatives to develop tools able to harmonize compliance with legal, security and regulatory requirements, privacy is still much of a grey zone.

From the EU’s standpoint, and regardless of the fact that the GDPR is seen as one of the most, if not the most sophisticated regulation in terms of protection of personal data, Mr. Schrems and the European Court of Justice (“ECJ”) are both playing a bit with the nerves of thousands of privacy professionals.

For those who do not know Mr. Schrems, Maximilian is an Austrian privacy activist. As a privacy law student in 2011 at the Santa Clara University, he met a Facebook representative who explained to the students that Europeans had many privacy rights in the EU but were however not doing much to protect them. The words didn’t fall on deaf ears and by 2015, Max had brought a case against Facebook, and achieved to get the Safe Harbor (the then used as a mechanism to transfer personal data to the United States) invalidated[3]. The Safe Harbor was replaced by the Privacy Shield, which – together with European Standard Clauses (“SCCs”) – were suspected of not being able to sufficiently protect European rights against US massive surveillance.

As you may have heard, on 16 July 2020[4], the Privacy Shield has been invalidated. The SCCs are still valid, but not sufficient per se. Following the Schrems II Decision, the European Commission issued some 22 pages of recommendations for the transfer of personal data outside the European Union[5] and the set of happy few countries considered as providing adequate protection, as well as a new draft set of SCCs[6].

So, what’s next for us? Below are a couple of answers to help you out navigating through 2021.

1. How much time do companies have to comply with the requirements of the Schrems II decision?

No grace period was provided by the ECJ: the consequences are applicable since 16 July 2020 and companies who used to rely on the Privacy Shield had to immediately stop using that mechanism and replace with the SCCs.

2. Are SCCs enough to transfer data outside of the EU?

No, SCCs are no longer enough on their own: companies need to assess on a case by case basis whether the laws of the recipient country offer enough protection AND where they don’t, they must include supplementary measures. In addition, if supplementary measures are not possible or insufficient, the parties must suspend, or end transfer OR the transfer must be suspended or ended by the data protection authority.

3. Now that the EU has issued new SCCs, will these replace the hassle of assessing the recipient’s country protections?

No – a simple update of the SCCs will not be enough. SCCs “are not capable of binding the authorities of that third country, since they are not party to the contract.” [7]. Hence, the requirement of implementing technically-enforced supplementary measures.

4. Is it dangerous not to comply with the Schrems II requirements?

It’s expensive and it could jeopardize your business since the Data Protection Authority may request to stop the transfer[8]. In terms of fines provided by the GDPR, we are talking about €20 million or 4% of their global turnover, whichever is greater[9].

5. Is Schrems II a C-Suite / Board level issue?

Yes- lack of corporate changes may constitute “willful blindness to a course of action” or “reckless conduct by knowing of the risk but doing nothing.”[10] This opens Board members and senior executives to potential personal and criminal liability.

6. Can’t I just use encryption or anonymization as Supplementary Measures enough to protect data?

No – that will not be enough. Encryption only protects data in transit and in storage, and anonymization is not recognized as existing by the European Data Protection Board (“EDPB”). Technically-enforced Supplementary Measures are required[11].

Anonymisation is very difficult to very difficult to achieve without deleting important value, and the new requirements under Pseudonymisation entails that the processing of personal data must be accomplished in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, which must be kept separately; and subject to technical and organisational measures able to ensure that the personal data cannot be attributed to identifiable persons without requiring access to the separately and securely stored “additional information.”

7. What types of processing are now clearly unlawful?

Two types of transfers have been designated as unlawful by the EDPB:

• Transfer to Cloud Services Providers or Other Processors Which Require Access to Data in the Clear (EDPB Unlawful Use Case 6); and
• Remote Access to Data for Business Purposes (EDPB Unlawful Use Case 7)[12].

The only option to render those as lawful is to provide for encryption.

8. What’s next for companies?

Companies need to evaluate what combination of SCCs, Additional Safeguards, data residency and Data Protection by Design and by Default will enable the continued success of business by fostering balanced protection of privacy, as well as legal and contractual trust in the use of technology and in the responsible, protected collection and processing of people’s data.

[1] General Data Protection Regulation 2016/679

[2] California Consumer Privacy Act, AB-375

[3] “Maximillian Schrems / Data Protection Commissioner”, decision 2000/520/CE, Case C-362/14

[4] https://edpb.europa.eu/sites/edpb/files/files/file1/20200724_edpb_faqoncjeuc31118_en.pdf

[5] Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf

[6]  The draft SCCshttps://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12741-Commission-Implementing-Decision-on-standard-contractual-clauses-for-the-transfer-of-personal-data-to-third-countries

[7]http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=9745404 paragraph 125.

[8]http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=9745404 paragraph 121, 135, 146, 154 and 203(3) 

[9] See GDPR Article 83(5)(c).

[10] https://normcyber.com/advisory-note/data-protection-directors-personal-liability/

[11] See EDPB Guidance at : https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf

[12] Ibid.