Important recommendations EDPB (European Data Protection Board) after Schrems ll and new standard contractual clauses

 in IT-recht, Privacy

After Schrems II and along with it the end of the EU-US Privacy Shield (July 2020) it became for many international companies very difficult to remain compliant under the GDPR while transferring personal data outside the European Economic Area (EEA). It was clear that the standard contractual clauses (SCC’S) in itself may be used, but the extra safeguards and measures to be taken and the reviewing of the third country legal and surveillance environment created uncertainty. The German DPA Baden-Württemberg was the first DPA to acknowledge this, and therefore gave some recommendations on how to approach this situation. The recommendations (November 10, 2020) of the EDPB, yet to be commented, are now very helpful for the complex task of assessing third countries and identifying appropriate supplementary measures where needed. The recommendations provide us with a series of steps to follow of which the way most companies already (should) operate. Steps include mapping all transfers first, verifying the transfer tool your transfer relies on, assessing the law of practice of the third country, and so on. The recommendations are suggesting various ideas for extra measures that could be taken.

The new SCC’s (draft) describe additional measurements as well. The processors and controllers have much more possibilities to select the module(s) applicable to their situation, which makes it possible to tailor their obligations under the SCC’s. In addition, the new clauses provide in more appropriate safeguards to afford a level of protection essentially equivalent to that guaranteed within the EU.

Furthermore, the EDPB have outlined the interesting phenomenon of the “ Warrant Canary”  whereby the data importer commits to regularly publish (e.g. at least every 24 hours) a cryptographically signed message informing the data exporter that as of a certain date and time it has received no order to disclose personal data or the like. The absence of an update of this notification will indicate to the exporter that the importer may have received an order.

The EDPB recommendations and the new SCC’s are a very welcome and useful addition for the practice in privacy land. For data importers  in third counties being compliant under the GDPR seems to be no longer hardly impossible.

Recente berichten
  • 5 januari 2022

    Massa is kassa!

    Sil Kingma
    Dat is niet alleen de goudenregel voor de succesvolle exploitatie van Mark Gilles’ vakantieparken, maar ook voor de exploitatie van de Wet afwikkeling massaschade door investeringsfondsen. Eerst even kort terug in de tijd. Op 4 december 2019 zijn in het Staatsblad twee Koninklijke Besluiten gepubliceerd op het gebied van collectieve acties. Deze Besluiten bevestigen de
    Lees verder
  • 22 december 2021

    Interview in Advocatenblad 2021 | 10 ‘Teamspelers in de IT’

    Hanneke Slager
    Lees hier het gehele artikel dat recent is gepubliceerd in het Advocatenblad over ons IT-kantoor. Teamspelers in de IT, door Erik Jan Bolsius, Beeld Jean-Pierre Jans  
    Lees verder
  • 16 december 2021

    Het verbetertraject voor een HR-professional en de waarde van achteraf opgestelde verklaringen. 

    Marion Hagenaars
    Een verbetertraject is onder andere afhankelijk van het niveau en de kennis van de werknemer. Maar  wat betekent dit voor een (HR-)professional? En kan het ontbreken van een verbetertraject worden gerepareerd met achteraf opgestelde verklaringen?
    Lees verder

Plaats een reactie