Tag: DPF

FAQs – Sub-Processor Lists – Transfer Mechanisms

SaaS suppliers and SaaS customers can only lawfully transfer personal data to sub-processors located outside of the UK, Switzerland or the EEA, (make a restricted transfer) if a recognised transfer mechanism is in place to protect the personal data being transferred.

Transfer Mechanisms

Currently the only transfer mechanisms are:

  • Adequacy, (EU Adequacy Decisions including the DPF);
  • EU Standard Contractual Clauses, (EU SCCs);
  • UK Standard Contractual Clauses, (UK SCCs);
  • Binding Corporate Rules, (BCRs)

If none of the above transfer mechanisms are used, no restricted transfer of personal data can be lawfully made.

Adequacy

The European Commission has currently awarded Adequacy Decisions to the following countries:

Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework)  and Uruguay .

A full list can be found on the European Commission website – Adequacy Decisions.

Data Privacy Framework (DPF)

The DPF is an opt-in certification scheme that can be used with sub-processors located in the USA to enable restricted transfers of personal data to be lawfully made to the USA. The DPF has been in force since the 10th of July 2024 and US entities can apply to be certified on the DPF website. Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data relying upon the DPF.

EU + UK SCCs

EU standard contractual clauses are a set out of standard clauses that have been approved by the EU Commission as providing adequate protection, when used to transfer EU personal data from the EU to a third country located outside of the EEA. Up until June 2021 there were two sets of standard contractual clauses that could be used for transfers of personal data between data controllers, and one set for transfers between a data controller and a data processor, (old EU SCCs). There were no clauses for transfers between data processors.

In June 2021 the EU Commission replaced the old EU SCCs with one new set of standard contractual clauses, (new EU SCCs) to cover 4 different types of data transfers in one document in 4 different modules:

  • Module 1: covers transfers from a data controller (SaaS supplier) to a data controller outside of the EEA (third party);
  • Module 2: covers transfers from a data controller (SaaS customer) to a data processor outside of the EEA (SaaS supplier);
  • Module 3: covers transfers from a data processor (SaaS supplier) to a data processor outside of the EEA (sub-processor); and
  • Module 4: covers transfers from a data processor (SaaS supplier) to a data controller (third party) outside of the EEA.

Is important to be aware that when EU SCCs are relied upon as a data transfer mechanism a data transfer assessment must also be carried out.

Binding Corporate Rules (BCRs)

BCRs only cover international transfers of personal data between companies within the same group.

Sub-Processor Lists

SaaS suppliers must list all sub-processors to whom they transfer personal data, in a sub-processer list. The sub-processor list usually forms part of the SaaS supplier’s data processing agreement, (“DPA”) which is often published on the SaaS supplier’s website or SaaS platform. The transfer mechanism used by each sub-processor must be identified in the sub-processor list.

A SaaS supplier’s current list of sub-processors must correctly identify the actual transfer mechanism relied upon by each sub-processor. Please note that:

  • since the introduction of the DPF, many US sub-processors no longer user SCCs as their transfer mechanism; and
  •  where a sub-processor list was created before March 2024, the “old” EU and UK SCCs must be replaced with the “new” EU and UK SCCs.

SaaS suppliers should also be aware that where any sub-processor uses SCCs as a transfer mechanism, SaaS suppliers must ensure that the data transfer assessment carried out for each such sub-processor is updated at least annually.

Actions to be taken now

Where SaaS suppliers make any restricted transfers of personal data to sub-processors, or to their group companies, affiliates, customers or suppliers, they may need to update their legal documentation to reflect the above current transfer mechanisms.

For example:

Where a restricted transfer of personal data is made by the SaaS supplier to a member of a group company or an affiliate located in the USA the SaaS supplier will need to:

  • apply for the US entity to be certified under the DPF;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the DPF rules;
  • amend any inter-company data processing agreements to reflect the new transfer mechanism.

Where a transfer of personal data is made to a customer, supplier or sub-processor located in the USA the SaaS supplier will need to:

  • amend its sub-processor list;
  • amend its data processing agreement;
  • amend its data transfer assessments;

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Restricted Transfers

Restricted transfers are a type of international data transfer to which special rules apply. SaaS suppliers and SaaS customers are responsible for complying with the relevant rules when making or permitting restricted transfers of personal data to their suppliers, customers, sub-processors, group companies and partners.

What is an international data transfer?

An international data transfer occurs when personal data is sent or transmitted from one country to another.

This includes:

  • sending personal data to an entity located in another country; and
  • making personal data available to an entity located in another country.

SaaS suppliers and SaaS customers should be aware that the storing or personal data in the UK/EEA i.e. in a data centre located in the UK, Switzerland or the EEA will not prevent a restricted transfer from taking place, unless the stored personal data cannot be accessed from, or sent to, an entity outside of the UK, Switzerland and the EEA.

What is a Restricted Transfer?

Examples of restricted transfers:

  • Emailing electronic documents containing personal data to another country
    i.e. using a third party email service
  • Sending electronic documents containing personal data to another country
    i.e. using a CRM SaaS service
  • Emailing records containing personal data to another country
    i.e. within a SaaS database
  • Allowing an entity based in another country access to documents or records containing personal data
    i.e. via a third party hosting centre
  • Allowing another entity in the same corporate group, based in another country access to UK/EU employee data
    i.e. for internal business purposes

Restricted Transfers from the EEA

The EU GDPR sets out the rules for making an international data transfer to an entity located outside the EEA. This is known as a “restricted transfer”.

In order for a restricted transfer to be lawful under the EU GDPR , additional safeguards must be in place.

Restricted Transfers from the UK

The UK GDPR sets out the rules for making an international data transfer to an entity located outside the UK. This is also known as a “restricted transfer”.

In order for a restricted transfer to be lawful under the UK GDPR, additional safeguards must be in place.

Who is responsible for a restricted transfer?

SaaS customers based in the UK, Switzerland or the EEA are responsible for making sure additional safeguards are in place before making restricted transfers of UK, Swiss or EEA personal data to their SaaS suppliers, group companies, suppliers or partners.

SaaS suppliers (processors) subject to the EU GDPR or the UK GDPR are responsible for making sure additional safeguards are in place before making restricted transfers of UK, Swiss or EEA personal data to their sub-processors, group companies, customers, suppliers or partners.

Transfer Mechanisms

SaaS suppliers and SaaS customers can only lawfully make restricted transfers of UK, Swiss or EEA personal data if they use a recognized transfer mechanism.

Currently these are:

  • Adequacy, (EU Adequacy Decisions, DPF);
  • EU Standard Contractual Clauses, (EU SCCs);
  • UK Standard Contractual Clauses, (UK SCCs);
  • Binding Corporate Rules, (BCRs)

If none of the above transfer mechanisms is used, no restricted transfer of personal data can be lawfully made.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Transfer Mechanisms

Below is a summary of the transfer mechanisms that can be relied upon to make a lawful transfer of UK, Swiss or EEA personal data to a country outside of the UK, Switzerland or the EEA.

Adequacy is granted when a recipient country is deemed to have data protection laws and practices similar to those of the sending country.

1. Adequacy Decisions

Restricted transfers can be made, without the need for any additional safeguards or measures to be put in place to protect the personal data, where personal data is sent to a country with an adequacy decision.

EU Transfers

EU Adequacy Decisions

The European Commission has currently awarded Adequacy Decisions to the following countries:

Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework)  and Uruguay.

UK, Japan, New Zealand, Uruguay and Switzerland. A full list can be found on the European Commission website – Adequacy Decisions.

EU-US Data Privacy Framework (DPF)

The European Commission agreed the DPF with the USA in July 2023 to permit restricted transfers of EEA personal data to from the EEA the USA. EEA personal data can be lawfully be transferred to organisations located in the USA that have been certified and meet the principles of the DPF.

Certification of any US entity can be checked via the DPF list.

UK Transfers

UK Adequacy Decisions

As a result of Brexit the UK awarded UK adequacy decisions to permit the transfer of personal data from the UK to:

  • the EEA; and
  • to any countries which covered by an EU Adequacy Decision.

This allows personal data to flow freely between the UK, the EEA and any countries awarded an EU Adequacy Decision.

Since Brexit, the UK Government has been granted its own powers to enter into UK Adequacy Decisions with countries that are outside of the EEA – but these only cover data being transferred from the UK.

One such UK Adequacy Decision has been granted to South Korea.

Currently the UK government is in discussions with the following countries for their own UK Adequacy Decisions:

  • Australia
  • Dubai
  • Kenya

UK-US Data Bridge

The UK government agreed its own transfer mechanism with the USA, the UK-US Data Bridge in September 2023. This will permit restricted transfers of UK personal data from the UK to the USA from the 12th October 2023.

Referred to by US authorities as the UK Extension to the DPF, entities based in the USA can sign up to the ‘UK Extension’ when registering under the DPF.

Certification of any US entity under the UK-US Data Bridge can be checked via the DPF list.

Swiss Transfers

Swiss-US Data Bridge

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged.

Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

2. Standard Contractual Clauses

EU Standard Contractual Clauses

In the absence of an EU Adequacy Decision, EU Standard Contractual Clauses (EU SCCs) can be used which the sender and the receiver of the personal data both sign up to. These contain mandatory contractual obligations designed to provide legal protection for personal data when transferred to a country that is not “adequate”.

UK Standard Contractual Clauses

In the absence of a UK Adequacy Decision, UK Standard Contractual Clauses (UK SCCs) can be used which the sender and the receiver of the personal data both sign up to. These contain mandatory contractual obligations designed to provide legal protection for personal data when transferred to a country that is not “adequate”.

Data Transfer Assessments

If a SaaS supplier or SaaS customer wishes to use EU SCCs or UK SCCs they must carry out a written data transfer assessment, (DTA) in order to determine whether personal data will be adequately protected. SCCs cannot be used unless such DTAs have been completed. In the EU the assessment is called a Transfer Impact Assessment, (TIA). In the UK, the assessment is called a Transfer Risk Assessment, (TRA).

3. Binding Corporate Rules (BCRs)

BCRs can be only used as a transfer mechanism for transfers of personal data between entities within a company group. Like SCCs, DTAs will need to be carried out where BCRs are relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection: UK-US Data Bridge

On Friday the 22nd of September 2023, the UK agreed its own international data transfer mechanism with the USA to cover transfers of personal data from the UK to the USA. The new transfer mechanism can be used by SaaS companies from October, instead of UK standard contractual clauses.

From the 12 October 2023, SaaS Suppliers and SaaS Customers can start to transfer UK personal data to entities located in the USA provided that the US entity is certified under the new “UK Extension to the EU-US Data Privacy Framework” (UK-US Data Bridge).

This now means that all transfers of UK personal data made to US companies certified under the UK-US Data Bridge by SaaS companies will be deemed to be to a third country that has adequate data protection laws.

Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data through the DPF.

What is the UK-US Data Bridge?

As result of Brexit, the UK was not included in the DPF as this only covers EU member states. The UK has therefore entered into its own agreement with the USA and this agreement is an extension to the DPF, known as the UK-US Data Bridge or the UK Extension. US organisations who have been certified to the DPF can opt in, to the UK Extension, to also receive personal data from the UK.

Once a US organisation has been certified and is publicly placed on the DPF List on the DPF website that includes the UK Extension, they can receive UK personal data through the UK-US Data Bridge.

The UK Extension of the DPF contains enforceable principles and requirements that must be certified to, and complied with, in order for a US organisation to be able to join the DPF. These principles take the form of commitments to data protection and govern how US organisations use, collect and disclose personal data.

The UK-US Data Bridge will be in force from the 12th of October and US entities can apply to be certified on the DPF website.

Once a US organisation has been certified and is publicly placed on the DPF List with the UK Extension included, they can receive UK personal data through the UK-US Data Bridge.

Which US organisations can certify under the DPF?

Only US organisations subject to the jurisdiction of the FTC or the DoT are currently eligible to participate in the DPF program. Those US organisations not subject to the jurisdiction of either the FTC or DoT — for example, banking, insurance, and telecommunications companies — are unable to participate in the DPF program at this time.

Data excluded from transfers under the DPF

Journalistic data defined by Supplemental Principle 2(b) of the DPF is not subject to the requirements of the DPF. Therefore, such data cannot be transferred under the UK-US Data Bridge.

Rules applicable to special category data

Special category and sensitive data can be shared with US organisations under the UK-US Data Bridge, however this must be correctly identified by UK organisations as such when it is being shared.

UK special category/sensitive personal data

Any UK personal data which is considered to be sensitive, and which is not covered by the definition applicable to EU personal data, it must be appropriately identified as sensitive to US organisations when transferred under the UK-US Data Bridge to ensure it receives appropriate protections.

This will include:

  • genetic data;
  • biometric data for the purpose of uniquely identifying a natural person;
  • data concerning sexual orientation

Where criminal offence data is proposed to be shared under the UK-US Data Bridge as part of a human resources (HR) data relationship, US recipient organisations are required to indicate that they are seeking to receive such data.

HR data is clarified under Human Resources Data Supplemental principle 9(a)(i) as:

  • personal information about its employees (past or present) collected in the context of the employment relationship [transferred] to a parent, affiliate, or unaffiliated service provider in the United States participating in the EU-US DPF.

Criminal offence data may also be shared outside of a HR relationship. When sharing criminal offence data it should be indicated to the US recipient organisation that it is sensitive data requiring additional protections, in line with protections for special category or sensitive data set out above.

UK Standard Contractual Clauses

Once a US entity is certified under the UK-US Data Bridge there is no longer any legal requirement for SaaS suppliers or SaaS customers to:

as such transfers will be deemed to be to an entity located in a third country that has adequate data protection laws.

However, if a SaaS company cannot rely on the UK-US Data Bridge to transfer UK personal data to the US for any reason, they will need to continue using UK standard contractual clauses or Binding Corporate Rules (BCRs) for such transfers to the USA. The requirement to carry out Schrems II data transfer assessments in addition will also continue.

What about Switzerland?

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged. Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

How to check registration under the UK-US Data Bridge

SaaS suppliers should check that the recipient of the UK personal data is certified with the UK-US Data Bridge. Certification can be checked on the DPF website.

It is important to check that the US organisation has signed up to both:

If any HR data will be transferred to the US organization:

  • the certification of the US organisation on the DPF website must highlight this; and
  • there must be a link in the company’s certification on the DPF website to the relevant privacy policy or policies (for HR data and/or non-HR data) under the “Privacy Policy” section of the record.

Actions to be taken now

Where SaaS companies transfer any UK personal data to their group companies, affiliates, customers, suppliers or sub-processors located in the USA they will need to update their legal documentation to reflect these changes.

Where a transfer of UK personal data is made to a member of a group company or affiliate located in the USA they will need to:

  • apply for the US entity to be certified under the UK-US Data Bridge;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the certification rules;
  • amend intercompany data processing agreements to reflect the new transfer mechanism.

Where a transfer of UK personal data is made to a customer, supplier or sub-processor located in the USA they will need to:

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection: EU-US Data Privacy Framework (DPF)

In July 2023 the EU-US Data Privacy Framework, (DPF) was finally agreed between the EU and the USA. The DPF now provides a new transfer mechanism for SaaS suppliers and SaaS customers to use when transferring EU personal data to the USA. The DPF can be used instead of EU standard contractual clauses.

This means that all transfers of EU personal data made to US companies certified under the DPF by SaaS companies will be deemed to be to a third country that has adequate data protection laws.

What is the DPF

The DPF is an opt-in certification scheme that can be used by organisations located in the USA to enable EU personal data to be lawfully transferred to the USA. The DPF is enforced by the Federal Trade Commission (FTC) and Department of Transportation (DoT), and administered by the Department of Commerce (DoC).

The DPF contains enforceable principles and requirements that must be certified to, and complied with, in order for a US organisation to be able to join the DPF. These principles take the form of commitments to data protection and govern how US organisations use, collect and disclose personal data.

The DPF has been in force since the 10th of July and US entities can apply to be certified on the DPF website.

Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data through the DPF.

Which US organisations can certify under the DPF?

Only US organisations subject to the jurisdiction of the FTC or the DoT are currently eligible to participate in the DPF program. Those US organisations not subject to the jurisdiction of either the FTC or DoT — for example, banking, insurance, and telecommunications companies — are unable to participate in the DPF program at this time.

Data excluded from transfers under the DPF

Journalistic data defined by Supplemental Principle 2(b) of the DPF is not subject to the requirements of the DPF. Therefore, such data cannot be transferred under the DPF.

Rules applicable to special category data

Special category and sensitive data can be shared with US organisations under the DPF.

EU special category/sensitive personal data

This covers personal data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual are considered sensitive information under the DPF. US organisations under the DPF are also required to treat as sensitive any information received which has been identified and previously been treated as sensitive by the organisation sharing the information.

EU Standard Contractual Clauses

Once a US entity is certified under the DPF there is no longer any legal requirement for SaaS suppliers or SaaS customers to:

  • use EU standard contractual clauses to make transfers of personal data; or
  • carry out Schrems II data transfer assessments; or
  • check that additional safeguards are in place to protect the personal data transferred;

as such transfers will be deemed to be to an entity located in a third country that has adequate data protection laws.

However, if a SaaS company cannot rely on the DPF to transfer EU personal data to the US for any reason, they will need to continue using EU standard contractual clauses or Binding Corporate Rules (BCRs) for such transfers to the USA. The requirement to carry out Schrems II data transfer assessments in addition will also continue.

What about Switzerland?

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged. Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

How to check registration under the DPF

SaaS suppliers should check that the recipient of the EU personal data is certified with the DPF. Certification can be checked on the DPF website.

It is important to check that the US organisation has signed up to both:

  • the DPF; and
  • the UK Extension to the EU-US Data Privacy Framework.

If any HR data will be transferred to the US organization:

  • the certification of the US organisation on the DPF website must highlight this; and
  • there must be a link in the company’s certification on the DPF website to the relevant privacy policy or policies (for HR data and/or non-HR data) under the “Privacy Policy” section of the record.

Actions to be taken now

Where SaaS companies transfer any EU personal data to their group companies, affiliates, customers, suppliers or sub-processors located in the USA they will need to update their legal documentation to reflect these changes.

Where a transfer of EU personal data is made to a member of a group company or affiliate located in the USA they will need to:

  • apply for the US entity to be certified under the DPF;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the certification rules;
  • amend intercompany data processing agreements to reflect the new transfer mechanism.

Where a transfer of EU personal data is made to a customer, supplier or sub-processor located in the USA they will need to:

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Restricted Transfers

SaaS suppliers and SaaS customers currently have to comply with complicated rules and include onerous obligations in their SaaS agreements, data processing agreements and data privacy practices to lawfully make restricted transfers of personal data when providing SaaS services. Before making any restricted transfers of personal data, SaaS suppliers must ensure that the specific safeguards required under the UK GDPR and the EU GDPR are in place.

What is a Restricted Transfer

When a SaaS supplier sends or transmits personal data to an entity located in a country outside of the EEA which is not deemed “adequate” by the European Commission, this a restricted transfer.

Examples of restricted transfers that SaaS suppliers usually make are:

  • Hosting of SaaS customer personal data, for example in data centres operated by entities established outside of the EEA, for example: AWS, Microsoft;
  • Using technology services of suppliers located outside of the EEA, for example: Cloudflare, Google;
  • Using sub-processors located outside of the EEA to provide services to SaaS customers, for example: Zendesk, Sendgrid, Zoom;
  • Transferring or sharing access to personal data with group companies located outside of the EEA.

What is a Transfer Mechanism

SaaS suppliers and SaaS customers are required by European data protection authorities and the GDPR to use a recognised transfer mechanism in order to make their restricted transfers of personal data lawful.

In the past the following transfer mechanisms were recognized as providing “adequacy”:

  • Safe Harbor – covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems I decision of the European Court of Justice in 2015;
  • EU – US Privacy Shield – replaced Safe Harbor and covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems II decision of the European Court of Justice in 2020.

Following the Schrems II decision, the only transfer mechanisms now recognised by the EU as being “adequate” are:

Additional Requirements

Following the Schrems II decision:

When using EU SCCs (or BCRs) as a transfer mechanism, EU SaaS suppliers and SaaS customers must also:

When using UK SCCs (or BCRs) as a transfer mechanism, UK SaaS suppliers and SaaS customers must also:

  • Implement supplemental safeguards when making restricted transfers; and
  • Carry out data transfer assessments, (DTAs).

Also: note that in the UK there are 2 different types of UK SCCs that can be used:

Google and Meta Decisions

However, in spite of compliance with the above obligations, Google has been declared by various EU data protection authorities, and more recently Meta, to be in breach of the GDPR for making unlawful restricted transfers of EU personal data. Meta has been fined €1.2bn (£1bn) and ordered to suspend all restricted transfers to the USA.

Meta is currently appealing this decision, and the fine awarded, and is continuing to make restricted transfers of personal data to the USA as the suspension only comes into effect in October 2023, by which time the new EU-US Data Privacy Framework (DPF) should have been granted “adequacy” by the European Commission, making the continued transfers to the USA lawful.

EU-US Data Privacy Framework – DPF

The DPF is the replacement transfer mechanism for the invalidated EU-US Privacy Shield to enable EU personal data to be transferred to the USA. The European Commission has indicated its intention to grant the DPF “adequacy” but like its predecessors, the DPF will probably be challenged by Mr Schrems and could again be declared invalid by the European Court of Justice at some point in the future.

Important note: The DPF can only be used by US businesses regulated by the Federal Trade Commission or the US Department of Transportation. Such businesses would need to self-certify compliance with the DPF.

UK – US Data Bridge

As the UK is no longer part of the EU following Brexit, it needs to agree its own transfer mechanism with the USA – that is also acceptable to the EU. The UK is referring to this new transfer mechanism as the UK-US Data Bridge and it appears to be an extension to the DPF specifically for the UK.

Summary

SaaS suppliers and SaaS customers need to closely watch developments over the coming months on the progress of these new proposed data transfer mechanisms in the US, EU and the UK.

However, even if the new transfer mechanisms are granted “adequacy” by the EU, they will only apply to transfers of personal data to the USA. SaaS suppliers and SaaS customers will still need to :

  • Have in place supplemental measures; and
  • Document data transfer impact assessments, (DTIAs) for any restricted transfers of personal data that rely upon SCCs that they make to other countries outside of the EEA, for example: Australia, Singapore etc.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements: EU-US Adequacy Decision – Update

Following the Schrems II judgment, the EU-US Privacy Shield was declared invalid, meaning that SaaS suppliers and SaaS customers have to use standard contractual clauses (SCS) or BCRs when making transfers of EEA (or UK) personal data to the USA. In addition, SaaS customers and SaaS suppliers are required to carry out a data transfer impact assessment (DTIA) prior to transferring any personal data from the EEA or UK to a “third country” i.e. the USA.

New US Adequacy Decision

In December 2022, the European Commission published its draft adequacy decision for the new EU-US Data Privacy Framework (DPF). If the European Data Protection Board (EDPB), the EU Member States and the European Parliament approve the DPF, the USA will be granted adequacy by the EU Commission and SCCs and BCRs will no longer be required for transfers of EEA personal data to the USA.

The final adequacy decision of the EU Commission is expected to be made by July 2023.

Similar to the EU-US Privacy Shield, companies in the USA can choose to join the DPF and must commit to certain privacy obligations.

Unlike the EU-US Privacy Shield, the DPF now:

  • limits access to EEA personal data by US intelligence agencies to what is necessary and proportionate; and
  • provides an independent and impartial complaints mechanism and a Data Protection Review Court.

UK Adequacy Decision

The UK government intends to grant its own adequacy decision for the USA. However, it is likely that the content of a UK adequacy decision may differ from the EU’s adequacy decision.

Schrems Challenge

In light of recent comments made by Max Schrems on the DPF, it is very likely that Mr Schrems will challenge the validity of the DPF in the European Court of Justice on the basis that:

  • the US Data Protection Review Court does not adequately protect data subject’s rights; and
  • the scope of permitted surveillance by US authorities under the DPF is too wide.

If the DPF is challenged, any UK – US adequacy decision would probably also be challenged.

Advantages of using the DPF

If the DPF is granted “adequacy” by the European Commission, SaaS suppliers and SaaS customers can use the DPF instead of relying upon SCCs or BCRs. Furthermore, as the DPF will be recognised in the EU as a lawfully valid transfer mechanism for transfers of personal data to the USA (until declared otherwise by the ECJ). This means that there will be no need for SaaS suppliers and SaaS customers to carry out any data transfer impact assessments (DTIA) in addition.

A legal challenge to any EU-US adequacy decision would probably take a couple of years to be resolved, meaning once in place, the DPF can be used as a valid transfer mechanism for transfers to the USA in the near future, provided that an adequacy decision is issued by the EU Commission.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here