An Overview Of The EU and UK Personal Data Transfer Requirements

An Overview Of The EU and UK Personal Data Transfer Requirements Presented by: Mrs. Evans Date: 16th April 2024 Purposes - Sharing Personal Data globally is common practice • Facilitates international trade & supports global business operations • Makes best use of global capabilities & accommodates third party providers such as cloud computing and support services. • Cost savings & economies of scale • Required as part of travel requirements • Helps intelligence gathering with global criminal investigations and other international co-operation matters - This session aims to provide an overview of the considerations from a UK/EU perspective but some of the practical points could apply generally. The Global Data Sharing Journey - Key Features • Accountability  Responsibilities need to be clearly defined and understood with data transfers. • Due Diligence  Ensure checks are undertaken to validate safe to share data. • Contracts  Check contracts have the appropriate data protection terms to cover sharing data. • Controls  Assessments maybe required prior to allowing data to be transferred including checking adequacy of security and technical controls. • Transparency  Ensure individuals are notified about where their data will be accessed and how it will be managed. Check country notification requirements • Record Keeping  Country data protection laws may require detailed records are maintained of processing activities. • Laws  Know the laws of the countries when personal data is shared. • Risk Management  Routinely risk assess to check third parties comply with agreed standards • Data Management  Keeping data updated and accurate is a legal requirement in many countries. • Deletion  Data should not be kept for longer than necessary. Ensure check third parties comply with deletion requirements applicable to any data they handle. - Right • Individuals have various rights in relation to their personal data check they are still applicable when data is shared. - Lawful Basis • A legal basis (e.g. consent) is required before data is transferred to other countries. Check the legal basis is acceptable and justified The Mechanisms - EU Legal Position - The EU data protection legislation that applies to Personal Data transfers is the General Data Protection Regulation 'GDPR'. Where EU personal data is transferred outside the European Economic Area 'EEA' (otherwise known as a Third Country) this restricted transfer is only permitted where one of the following conditions apply: • the European Commission 'EC' has declared that the Third Country ensures an adequate level of protection for the Data Subjects' rights • The EU data protection legislation that applies to Personal Data transfers is the General Data Protection Regulation 'GDPR'. Where EU ci personal data is transferred outside the European Economic Area 'EEA' (otherwise known as a Third Country) this restricted transfer is only permitted where one of the following conditions apply: • And freedoms. Countries deemed 'adequate' by the EC: Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom (under the GDPR and the LED 'Law Enforcement Directive'), the United States (for commercial organizations certified under the EU-US Data Privacy Framework) and Uruguay • Appropriate safeguards exists such as the use of standard contractual clauses 'SCCs' as approved by the EC used to govern the transfer of the Personal Data and any applicable supplementary measures: [Note other examples are listed in Article 46 of the General Data Protection Regulation 'GDPR' and include but are not limited to approved codes of conduct or certification mechanism or binding corporate rules.] • Any other derogation permitted under the Data Protection Legislation for specific situations, such as the transfer being necessary for the establishment, exercise or defense of legal claims. The Mechanisms - UK Legal Position - The UK's data protection legislation that applies to transfers is the UK GDPR that sits alongside the amended Data Protection Act 2018. Transfers from the UK to the EEA and vice versa can generally flow freely. Although the adequacy decision status of the UK is monitored by the EU Commission and due for formal review in June 2025. - Where a UK citizen's personal data is transferred outside the UK (a restricted transfer) then it is only permitted where one of the following conditions apply: • The transfer is subject to country adequacy decision; (UK GDPR Article 45) • Appropriate safeguards as in the UK GDPR (Article 46), such as International Data Transfer Agreement 'IDTA', BCR, approved certification/code of conduct are in place and applicable risk assessments, Transfer Risk Assessments, carried out; • Falls with an exception provided for in the UK GDPR (Article 49) these derogations for specific situations apply e.g. explicit informed consent, contract necessity in interests of data subject, defense of legal claims etc. - - - The Exceptions - Article 49 • Explicit consent • Contract • Public Interest • Legal Claim • Protect Vital Interests • Public register access • Debbie Evans • One-off transfer Examples of considerations for reliance: • Typically apply by exception! • Should be used for limited numbers of data subjects • Limited and necessary data types • Risk assessed • Compelling legitimate interests • Ruled out other alternative options to data transfer • Risks of harm minimal • Protections available Examples: • A travel company booking a non-routine hotel (one off) versus routine overseas conference center booking.(routine) • A UK citizen is in a coma in US and medical details urgently required. (emergency) The Mechanisms – Schrems - Requirements in relation to EU data transfers have become more stringent due to changes following the Schrems II case. • Schrems II case - made it clear that signing Standard Contract Clauses 'SCCs' is not enough as a case-by-case assessment is required by exporting organizations to demonstrate personal data (and data subjects) remain protected in an equivalent manner. • As a consequence of Schrems II, the EU- US Privacy Shield was deemed invalid. - The European Data Protection Board has issued recommendations and identified key steps to follow when exporting Personal Data, known as a Transfer Impact Assessment which requires: • Knowing your transfers [data mapping review element such as the creation of records of processing activities] • Identifying your transfer tool [such as adequacy decision, SCCs, Binding Corporate Rules 'BCRs' etc.] • Assessing the laws and surveillance practices in the third country [assess equivalence of data protection as per GDPR and consider potential access to personal data by public authorities including rights and remedies to data subjects] • Identifying any supplementary measures [additional security, technical or organizational controls to mitigate any identified risks] • Implementing the supplementary measures • Review and routinely evaluate any changes to country laws/regulations Challenges - EU/UK approach How do organizations accommodate different requirements? - How do organizations know when they have done enough? - What resources and approach is required? - How about broader international requirements? Considerations – Summary Examples Areas International transfers of user data Considerations Have assessments been taken to assess risk? Is the transfer necessary? Areas Purposes & lawfulness of transfers User data sharing Categories of personal data transferred Sources of user data collection Data storage Individual privacy rights Data security Retention and disposal Considerations Are the purposes justified? What about transparency/disclosure of intended transfers - is this clear? What personal data is being shared with third parties? What controls/safeguards exist? Have the transparency requirements been addressed? Is it clear what data will be transferred? Can it be limited? Where is the personal data coming from? Do the appropriate safeguards exist? Is the lawful basis appropriate? How secure are any data storage options if overseas? Are there alternative options? Do contracts cover all stages of data lifecycle? E.g is it clear what happens when contracts end? How are individual rights safeguarded? Is it straight forward for them to exercise their rights? Have any security provisions been validated by the security experts to ensure sufficiently robust? What mechanisms/processes exist to ensure personal data is not stored/processed for longer than necessary?