Important recommendations EDPB (European Data Protection Board) after Schrems ll and new standard contractual clauses

 in IT-recht, Privacy

After Schrems II and along with it the end of the EU-US Privacy Shield (July 2020) it became for many international companies very difficult to remain compliant under the GDPR while transferring personal data outside the European Economic Area (EEA). It was clear that the standard contractual clauses (SCC’S) in itself may be used, but the extra safeguards and measures to be taken and the reviewing of the third country legal and surveillance environment created uncertainty. The German DPA Baden-Württemberg was the first DPA to acknowledge this, and therefore gave some recommendations on how to approach this situation. The recommendations (November 10, 2020) of the EDPB, yet to be commented, are now very helpful for the complex task of assessing third countries and identifying appropriate supplementary measures where needed. The recommendations provide us with a series of steps to follow of which the way most companies already (should) operate. Steps include mapping all transfers first, verifying the transfer tool your transfer relies on, assessing the law of practice of the third country, and so on. The recommendations are suggesting various ideas for extra measures that could be taken.

The new SCC’s (draft) describe additional measurements as well. The processors and controllers have much more possibilities to select the module(s) applicable to their situation, which makes it possible to tailor their obligations under the SCC’s. In addition, the new clauses provide in more appropriate safeguards to afford a level of protection essentially equivalent to that guaranteed within the EU.

Furthermore, the EDPB have outlined the interesting phenomenon of the “ Warrant Canary”  whereby the data importer commits to regularly publish (e.g. at least every 24 hours) a cryptographically signed message informing the data exporter that as of a certain date and time it has received no order to disclose personal data or the like. The absence of an update of this notification will indicate to the exporter that the importer may have received an order.

The EDPB recommendations and the new SCC’s are a very welcome and useful addition for the practice in privacy land. For data importers  in third counties being compliant under the GDPR seems to be no longer hardly impossible.

Recente berichten
  • 11 mei 2021

    INPLP article May 11, 2021

    Wouter Huisman
    Bob Cordemeyer
    Fine of €475,000 for reporting data breach 22 days to late. According to a press release of April 6 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) imposed a €475,000 fine on because the company took too long to report a data breach to the DPA into compliance with Article 33 GDPR.
    Lees verder
  • 13 april 2021

    Het doolhof van de wet- en regelgeving op het gebied van de zieke werknemer: deel 1.

    Marion Hagenaars
    Wie bepaalt: de bedrijfsarts of het UWV? Verzuimbegeleiding en re-integratie De werkgever is verantwoordelijk voor de verzuimbegeleiding en re-integratie van de zieke werknemer. De werknemer is verplicht om aan zijn re-integratie mee te werken. In de Arbeidsomstandighedenwet is bepaald dat de werkgever zich hierbij moet laten bijstaan door een gecertificeerde arbodienst of bevoegde bedrijfsarts. De
    Lees verder
  • 17 februari 2021

    440,000 EUR fine for Dutch hospital OLVG for access by unauthorized personnel to medical records

    Bob Cordemeyer
    On 11 February 2021 the Dutch Data Protection Authority imposed a fine of EUR 440.000, = on Amsterdam hospital OLVG for having no sufficient measures in place to prevent access to medical records by unauthorized personnel and therefore infringing article 32 (1) GDPR. An investigation was started after the DPA received several complaints of potential violations.
    Lees verder

Plaats een reactie