EDPB adopts final Recommendation 01/2020 on Supplementary Measures for Data Transfers to Third Countries
On June 21st, 2021 during its 50th plenary session, the European Data Protection Board (EDPB) adopted a final version of its recommendations on the supplementary measures for data transfers.
In its recent judgment C-311/18 (Schrems II) the Court of Justice of the European Union (CJEU) has decided that, while the Standard Contractual Clauses (SCCs) are still a valid data transfer mechanism, controllers or processors, acting as exporters, are responsible for verifying, on a case-by-case basis and where appropriate, in collaboration with the importer in the third country, if the law or practice of the third country impinges on the effectiveness of the appropriate safeguards contained in the Article 46 GDPR transfer tools. In the cases where the effectiveness of appropriate safeguards is reduced due to the legal situation in the third country, exporters may need to implement additional measures that fill the gaps.
To help exporters with the complex task of assessing third countries and identifying appropriate supplementary measures where needed, the EDPB has adopted this recommendation. They highlight steps to follow, potential information sources as well as non-exhaustive examples of supplementary measures that are meant to help exporters make the right decisions for data transfers to third countries.
The recommendations advise exporters to follow the following steps in order to have a good overview of data transfers and potential supplementary measures necessary:
1. Know the data transfers that take place in your organization – being aware of where data flows is essential to identify potentially necessary supplementary measures;
2. Verify the transfer tool that each transfer relies on and its validity as well as application to the transfer;
3. Assess if a law or a practice in the third country impinges on the effectiveness of the transfer tool;
4. Identify and adopt supplementary measures that are necessary to bring the level of protection of the data transferred up to the EU standard;
5. Take formal procedural steps that may be required by the adoption of your supplementary measure, depending on the transfer tool you are relying on;
6. Re-evaluate the level of protection of the data you transfer at appropriate intervals and monitor any potential changes that may affect the transfer.
The EDPB Chair, Andrea Jelinek, stated that “the effects of Schrems II cannot be underestimated”, and that the “EDPB will continue considering the effects of the Schrems II ruling and the comments received from stakeholders in its future guidance”.
The recommendations clearly highlight the importance of exporters to understand and keep an eye on their data transfers to third countries. In Germany, the Supervisory Authorities have already started (in German) to send out questionnaires to controllers regarding their data transfers to third countries and the tools used to safeguard the transfers. Controllers in the EU should be very aware of the subject of data transfers in their companies, and prepare accordingly.
