Considerations and Mechanisms for EU and UK Data Transfers

Considerations and Mechanisms for EU and UK Data Transfers Presented by: Mrs. Evans Date: 23th April 2024 EU/UK Further Example Considerations - - UK based organizations that process EU citizen Personal Data may need: • To appoint an EU representative • Identify applicable lead supervisory authority in EU UK organizations that transfer UK and EU citizens Personal Data to non-adequate countries: • To use EU SCCs and UK's IDTA addendum or other restricted transfer mechanism • - Undertake TIA and consider supplementary measures Non-EU/UK organizations that process UK and/or EU Personal Data: • To use applicable data transfer contracts and • Appoint UK and/or EU representatives • Check the identify of applicable supervisory authorities e.g. ICO and/or lead in EU - It is the responsibility of the data exporter to assess the data transfer risks and identify and implement any supplementary measures. EU/UK Contract Mechanism Overview - EU Standard Contract Clauses • The SCCs address various transfer scenarios and the complexity of modern processing chains. Data controllers and processors can use several options, depending on the specific circumstances of the transfer, which include:  controller-to-controller (C2C);  controller-to-processor (C2P);  processor-to-processor (P2P);  processor-to-controller (P2C), the processor being in the EU and the controller in a third country. • Other important aspects of the SCCs include:  a possibility for more than two parties to adhere to the clauses;  a possibility, with some exceptions, to use SCCs when transferring personal data to a sub- processor in a non-EEA country;  a possibility, with some exceptions, for individuals to invoke the clauses as third-party beneficiaries;  rules on liability between the parties in case individuals' rights are breached;  Individuals' right to compensation for damage suffered when their rights as a third-party beneficiary have been breached; a requirement to carry out a "transfer impact assessment" documenting the specific circumstances of the transfer, the laws in the country of destination and the additional safeguards put in place to protect the personal data;  obligations in case of access by public authorities to the data transferred, e.g. the obligation to provide information to data exporters and to challenge unlawful requests UK International Data Transfer Agreement - Exporters can use the IDTA or Addendum as a transfer tool to comply with Article 46 The UK Addendum incorporates the new EU SCCS and accommodates for Personal Data transfer of UK and EU citizens. - Note: all contracts should operate with the new EU SCCs and/or UK equivalent from 21st March 2024. EU-US Data Privacy Framework - EU-US Privacy Framework - 10th July the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework for organizations in the US - Introduced new binding safeguards such as • Signals Intelligence Activities'; • establishment of Data Protection Review Court to review and resolve EU citizen complaints - Impact to Businesses: • Can certify their participation in the EU-US Data Privacy Framework - ie by committing to privacy principles and obligations around data sharing and security. (Administered by US Department of Commerce) or • Continue to use EU Standard Contract Clauses and apply EU recommended safeguards for transfers. [Consider requirement to complete Transfer Impact Assessments - risk profile is likely to reduce for US transfers but suggest they still may be required to be completed in any event.] - Points to Note: • Current Framework still open to challenge by Schrems. • Contracts whether certified or not are still required - although the contractual process for certified organizations arguably maybe more straightforward in the long run. • Organizations are still subject to the obligations connected with personal data safeguards and suitability of security measures. As dictated by applicable contract terms - so even if just rely on SCCs in theory the associated obligations contained within align with requirements for certification. Although clearly the initial self-certification process is more prescriptive. • Only those companies subject to the jurisdiction of either the Federal Trade Commission (FTC) or the US Department of Transportation (DOT) are eligible to self-certify their compliance with the DPF. The scope of eligibility is likely to broaden in the future. Hence excludes banking, insurance and telecommunication's companies. - Reliance on the Data Privacy Framework is subject to certification of organizations compliance with the following principles: • Notice – an organization must clearly inform individuals about its participation in the EU-US DPF and provide specific details prior to any transfer and associated processing of their personal data. • Security – organizations processing personal data must take reasonable and appropriate measures to protect it and take into account the risks associated with the processing and given the type of personal data. • Recourse, Enforcement and Liability – organizations are required to implement effective mechanisms for compliance with the Principles and recourse for individuals impacted by non-compliance. Organizations should engage expeditiously with any associated complaints and/or requests for information from individuals and/or regulatory bodies. • Choice – the appropriate lawful basis should be applied namely consent or contract (in certain circumstances). Individual's rights to opt out and/or be clearly informed about changes to processing purposes should be respected. Note explicit individual consent maybe required when transferring sensitive personal data. • Data Integrity and Purpose Limitation – personal data should only be processed for the purposes originally obtained and any personal data must be reliable for its intended use, accurate, complete and current. • Accountability for Onward Transfer – contracts and/or clear terms are required clarifying respective parties' responsibilities to ensure for example that personal data is processed for any specified purposes and that processing should stop if can no longer comply with Principles. • Access – ensuring individuals have rights of access to personal data that an organization holds about them, along with other rights such as deletion and correction. Data Privacy Framework Supplemental Principles - There are a number of Supplemental Principles that provide additional requirements in relation to EU-US transfers some apply irrespective of whether an organization has certified to the DPF: for example the obligation to have contracts in place for onward transfers. - Other Supplemental Principles provide further guidance on the use of Sensitive Data, the requirements for Self-Certification and the transparency requirements associated with Access Requests by Public Authorities. Steps For EU Organizations - Data Controllers in the EU are required to enter into a contract when a transfer is made for processing purposes only - even if the US recipient is certified as a DPF participant. - Recommended steps are as follows: Prior to any personal data transfer to US check the Data Privacy Framework status - certified or not. Check the Data Privacy Framework List - If not certified consider the appropriate transfer mechanisms: e.g. Standard Contracts Clauses and associated supplementary measures/safeguards. - US organizations should consider whether there are applicable benefits to selfcertifying to the Data Privacy Framework. - Whilst there is an initial administrative burden to set- up it provides the following: - Ease of doing business in the EU as an organization would be deemed to provide 'adequate' data protection; - Improved data protection compliance controls; and Enhanced business opportunities as a trusted organization. UK-US Data Bridge - The UK-US Data Bridge came into force on the 12th of October and simplifies transfers of personal for companies that have self-certified to the EU-US Data Privacy Framework. • Where US companies extend their DPF certifications to cover UK personal data as well as EU data, the transfers from the UK to the US will be covered by the UK-U.S. Data Bridge. • Organizations will be exempted from implementing the UK International Data Transfer Agreement or other UK GDPR 'appropriate safeguards' for such transfers. However, such mechanisms remain valid options for transfers to the US and organizations should consider which is more suitable on a case-by-case scenario. • As an extension of the EU-US Data Privacy Framework, when relying on the UK-US Data Bridge organizations must take into consideration potential legal challenges to the mechanism. Impact to Organizations - Companies that wish to rely on the UK extension must review their data recipients, data flows and update documentation as applicable. - Lawfulness & Security of Transfers • Data transferred to third countries (and not just the US) should only be transferred as prescribed by the UK government. • Review US transfer safeguards and related reasoning in place are sufficient. • Update privacy policies and document processing activities as necessary to reflect any changes in how transfers of personal data to the US are done. - Prior to transferring UK data under the Extension • Confirm whether the recipient is an active DPF participant • Confirm that the recipient has signed up to the UK Extension to the EU-US Data Privacy Framework program • If wishing to transfer HR data for example, confirm that HR data is covered by the organization’s DPF commitments • - Review the recipient's privacy policy that applies to the covered information Exclusions • Organizations not subject to the jurisdiction of either the US Federal Trade Commission (FTC) or the US Department of Transportation (DoT) such as banking, insurance, and telecommunications companies are unable to participate in the transfers program, although scope may be extended. • Journalistic data is not subject to the requirements of the EU-US Data Privacy Framework and cannot be transferred under the UK-US Data Bridge. Cases – Examples Of Companies Where Things Have Gone Wrong And Why - Meta Irish Data Protection Commission | May 2023 - The Irish Data Protection Commission (DPC) imposed a €1.2 billion fine on Meta Platforms Ireland for their unlawful transfers of personal data to the U.S - Summary: DPC's inquiry into Meta, which started in 2020, found data transfers to its counterpart in the US, Meta Platforms, were violating Article 46(1) of the GDPR. It was found that the transfers were made on the basis of the European Commission's 2021 Standard Contractual Clauses (SCCs). The transfer included a Transfer Impact Assessment. - The DPC found that while the transfers took place on the basis of the SCCs as well as additional measures, these procedures were not sufficient to compensate for the inadequate protection provided by US laws. The DPC found the data protection provided by the US to be lacking when compared to the protection provided by the EU law. They also found Meta's safeguarding measures to be insufficient when US laws came into the picture. - Outcome: In addition to the 1.2 billion fine, Meta was ordered to change their processing operations to comply with Chapter V of the GDPR and to cease unlawful processing and storage of personal data (from EUEEA transfers) in the US. Transfers of personal data to the US were ordered to be suspended. - Key Takeaways: When transferring data across borders, it is essential to take into consideration the privacy laws and data protection offered by the source location as well as the target location. Often, there are multiple differences and nuances between both locations. All data transfers should happen in compliance with the privacy laws of both locations. Operational Requirements - Data transfers involve a personal data "importer" and "exporter". Conducting the Transfer Impact Assessment (TIA) is the obligation of the Data Exporter. - Data Exporter TIA Requirements • Know your transfer: map the data sharing arrangements, including third parties, duration, data types. Ensure that the data transferred is limited to what is necessary. • Verify your transfer tool: If there is no adequacy decision, Article 46 or 49 • Assess the laws of the "third country": confirm if there are law/practices in the third country that may impact the transfer tool and safeguards. • Identify supplementary measures: measures like encryption or anonymization that will bring the level up to essentially the EU standard.  Determine if there is an acceptable level of risk for the transfer Checklist - Know the Laws • Be aware of the data protection laws in both the sending and receiving countries and ensure that you are complying. - Assess risks • Review any third party proposed processing activity - Pre-processing and due diligence activity; (e.g. undertaking Vendor Assessments containing data protection applicable questions.) • Undertake any required pre-processing assessments, such as Privacy Impact Assessments, Data Protection Impact Assessment and Transfer Assessments - Identify the data • Know what data you are transferring and ensure that you have obtained the necessary consent from the individuals whose data you are sharing and/or have the appropriate lawful basis for processing the data. Establish the details of the processing activity and maintain any applicable records - Safeguard the data • Take appropriate measures to protect the data during transfer, such as encryption or secure file transfer protocols. Implement any other required safeguards and controls. - Have appropriate contracts • Have appropriate contracts in place with the receiving party, such as data processing agreements or standard contractual clauses, to ensure that the data is being handled appropriately and in compliance with relevant laws. - Monitor and Review the transfer • Regularly monitor and review the transfer of data to ensure that it is being handled appropriately and that there are no breaches or unauthorized access - Train employees • Ensure that all employees involved in the transfer of personal data are trained on data protection laws and the proper handling of personal data. - Be transparent • Be transparent with individuals about the transfer of their personal data and provide them with information about how their data is being protected. Review and update any required Privacy Notices.