Important recommendations EDPB (European Data Protection Board) after Schrems ll and new standard contractual clauses

 in IT-recht, Privacy

After Schrems II and along with it the end of the EU-US Privacy Shield (July 2020) it became for many international companies very difficult to remain compliant under the GDPR while transferring personal data outside the European Economic Area (EEA). It was clear that the standard contractual clauses (SCC’S) in itself may be used, but the extra safeguards and measures to be taken and the reviewing of the third country legal and surveillance environment created uncertainty. The German DPA Baden-Württemberg was the first DPA to acknowledge this, and therefore gave some recommendations on how to approach this situation. The recommendations (November 10, 2020) of the EDPB, yet to be commented, are now very helpful for the complex task of assessing third countries and identifying appropriate supplementary measures where needed. The recommendations provide us with a series of steps to follow of which the way most companies already (should) operate. Steps include mapping all transfers first, verifying the transfer tool your transfer relies on, assessing the law of practice of the third country, and so on. The recommendations are suggesting various ideas for extra measures that could be taken.

The new SCC’s (draft) describe additional measurements as well. The processors and controllers have much more possibilities to select the module(s) applicable to their situation, which makes it possible to tailor their obligations under the SCC’s. In addition, the new clauses provide in more appropriate safeguards to afford a level of protection essentially equivalent to that guaranteed within the EU.

Furthermore, the EDPB have outlined the interesting phenomenon of the “ Warrant Canary”  whereby the data importer commits to regularly publish (e.g. at least every 24 hours) a cryptographically signed message informing the data exporter that as of a certain date and time it has received no order to disclose personal data or the like. The absence of an update of this notification will indicate to the exporter that the importer may have received an order.

The EDPB recommendations and the new SCC’s are a very welcome and useful addition for the practice in privacy land. For data importers  in third counties being compliant under the GDPR seems to be no longer hardly impossible.

Recente berichten
  • 27 december 2023

    Europe’s AI Act: The genie still out of the bottle?

    Emmely Schaaphok
    “The genie is out of the bottle. We need to move forward on artificial intelligence development but we also need to be mindful of its very real dangers. I fear that AI may replace humans altogether.” This quote from Stephen Hawking in 2017 is more relevant today than ever.
    Lees verder
  • 4 april 2023

    INPLP Activity Report 2022

    Bob Cordemeyer
    Hereunder you can read the Activity Report 2022 from our network INPLP (International Network of Privacy Law Professionals) of which our firm is a founding member since 2015.
    Lees verder
  • 21 november 2022

    Risicomanagement: voorkom uitval door burn-out

    Marion Hagenaars
    Mirjam Scheper
    Werkend Nederland heeft steeds meer te kampen met burn-out klachten. Dit kan leiden tot (langdurig) ziekteverzuim. Een hoofdpijndossier en kostenpost voor de werkgever. En daarnaast een peperdure levensles voor de werknemer. Uitval door burn-out klachten voorkomen is dan ook beter dan genezen. Maar hoe?
    Lees verder

Plaats een reactie

Top