Tag: DTA

SaaS Agreements – FAQs – Transfer Mechanisms

Below is a summary of the transfer mechanisms that can be relied upon to make a lawful transfer of UK, Swiss or EEA personal data to a country outside of the UK, Switzerland or the EEA.

Adequacy is granted when a recipient country is deemed to have data protection laws and practices similar to those of the sending country.

1. Adequacy Decisions

Restricted transfers can be made, without the need for any additional safeguards or measures to be put in place to protect the personal data, where personal data is sent to a country with an adequacy decision.

EU Transfers

EU Adequacy Decisions

The European Commission has currently awarded Adequacy Decisions to the following countries:

Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework)  and Uruguay.

UK, Japan, New Zealand, Uruguay and Switzerland. A full list can be found on the European Commission website – Adequacy Decisions.

EU-US Data Privacy Framework (DPF)

The European Commission agreed the DPF with the USA in July 2023 to permit restricted transfers of EEA personal data to from the EEA the USA. EEA personal data can be lawfully be transferred to organisations located in the USA that have been certified and meet the principles of the DPF.

Certification of any US entity can be checked via the DPF list.

UK Transfers

UK Adequacy Decisions

As a result of Brexit the UK awarded UK adequacy decisions to permit the transfer of personal data from the UK to:

  • the EEA; and
  • to any countries which covered by an EU Adequacy Decision.

This allows personal data to flow freely between the UK, the EEA and any countries awarded an EU Adequacy Decision.

Since Brexit, the UK Government has been granted its own powers to enter into UK Adequacy Decisions with countries that are outside of the EEA – but these only cover data being transferred from the UK.

One such UK Adequacy Decision has been granted to South Korea.

Currently the UK government is in discussions with the following countries for their own UK Adequacy Decisions:

  • Australia
  • Dubai
  • Kenya

UK-US Data Bridge

The UK government agreed its own transfer mechanism with the USA, the UK-US Data Bridge in September 2023. This will permit restricted transfers of UK personal data from the UK to the USA from the 12th October 2023.

Referred to by US authorities as the UK Extension to the DPF, entities based in the USA can sign up to the ‘UK Extension’ when registering under the DPF.

Certification of any US entity under the UK-US Data Bridge can be checked via the DPF list.

Swiss Transfers

Swiss-US Data Bridge

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged.

Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

2. Standard Contractual Clauses

EU Standard Contractual Clauses

In the absence of an EU Adequacy Decision, EU Standard Contractual Clauses (EU SCCs) can be used which the sender and the receiver of the personal data both sign up to. These contain mandatory contractual obligations designed to provide legal protection for personal data when transferred to a country that is not “adequate”.

UK Standard Contractual Clauses

In the absence of a UK Adequacy Decision, UK Standard Contractual Clauses (UK SCCs) can be used which the sender and the receiver of the personal data both sign up to. These contain mandatory contractual obligations designed to provide legal protection for personal data when transferred to a country that is not “adequate”.

Data Transfer Assessments

If a SaaS supplier or SaaS customer wishes to use EU SCCs or UK SCCs they must carry out a written data transfer assessment, (DTA) in order to determine whether personal data will be adequately protected. SCCs cannot be used unless such DTAs have been completed. In the EU the assessment is called a Transfer Impact Assessment, (TIA). In the UK, the assessment is called a Transfer Risk Assessment, (TRA).

3. Binding Corporate Rules (BCRs)

BCRs can be only used as a transfer mechanism for transfers of personal data between entities within a company group. Like SCCs, DTAs will need to be carried out where BCRs are relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Restricted Transfers

SaaS suppliers and SaaS customers currently have to comply with complicated rules and include onerous obligations in their SaaS agreements, data processing agreements and data privacy practices to lawfully make restricted transfers of personal data when providing SaaS services. Before making any restricted transfers of personal data, SaaS suppliers must ensure that the specific safeguards required under the UK GDPR and the EU GDPR are in place.

What is a Restricted Transfer

When a SaaS supplier sends or transmits personal data to an entity located in a country outside of the EEA which is not deemed “adequate” by the European Commission, this a restricted transfer.

Examples of restricted transfers that SaaS suppliers usually make are:

  • Hosting of SaaS customer personal data, for example in data centres operated by entities established outside of the EEA, for example: AWS, Microsoft;
  • Using technology services of suppliers located outside of the EEA, for example: Cloudflare, Google;
  • Using sub-processors located outside of the EEA to provide services to SaaS customers, for example: Zendesk, Sendgrid, Zoom;
  • Transferring or sharing access to personal data with group companies located outside of the EEA.

What is a Transfer Mechanism

SaaS suppliers and SaaS customers are required by European data protection authorities and the GDPR to use a recognised transfer mechanism in order to make their restricted transfers of personal data lawful.

In the past the following transfer mechanisms were recognized as providing “adequacy”:

  • Safe Harbor – covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems I decision of the European Court of Justice in 2015;
  • EU – US Privacy Shield – replaced Safe Harbor and covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems II decision of the European Court of Justice in 2020.

Following the Schrems II decision, the only transfer mechanisms now recognised by the EU as being “adequate” are:

Additional Requirements

Following the Schrems II decision:

When using EU SCCs (or BCRs) as a transfer mechanism, EU SaaS suppliers and SaaS customers must also:

When using UK SCCs (or BCRs) as a transfer mechanism, UK SaaS suppliers and SaaS customers must also:

  • Implement supplemental safeguards when making restricted transfers; and
  • Carry out data transfer assessments, (DTAs).

Also: note that in the UK there are 2 different types of UK SCCs that can be used:

Google and Meta Decisions

However, in spite of compliance with the above obligations, Google has been declared by various EU data protection authorities, and more recently Meta, to be in breach of the GDPR for making unlawful restricted transfers of EU personal data. Meta has been fined €1.2bn (£1bn) and ordered to suspend all restricted transfers to the USA.

Meta is currently appealing this decision, and the fine awarded, and is continuing to make restricted transfers of personal data to the USA as the suspension only comes into effect in October 2023, by which time the new EU-US Data Privacy Framework (DPF) should have been granted “adequacy” by the European Commission, making the continued transfers to the USA lawful.

EU-US Data Privacy Framework – DPF

The DPF is the replacement transfer mechanism for the invalidated EU-US Privacy Shield to enable EU personal data to be transferred to the USA. The European Commission has indicated its intention to grant the DPF “adequacy” but like its predecessors, the DPF will probably be challenged by Mr Schrems and could again be declared invalid by the European Court of Justice at some point in the future.

Important note: The DPF can only be used by US businesses regulated by the Federal Trade Commission or the US Department of Transportation. Such businesses would need to self-certify compliance with the DPF.

UK – US Data Bridge

As the UK is no longer part of the EU following Brexit, it needs to agree its own transfer mechanism with the USA – that is also acceptable to the EU. The UK is referring to this new transfer mechanism as the UK-US Data Bridge and it appears to be an extension to the DPF specifically for the UK.

Summary

SaaS suppliers and SaaS customers need to closely watch developments over the coming months on the progress of these new proposed data transfer mechanisms in the US, EU and the UK.

However, even if the new transfer mechanisms are granted “adequacy” by the EU, they will only apply to transfers of personal data to the USA. SaaS suppliers and SaaS customers will still need to :

  • Have in place supplemental measures; and
  • Document data transfer impact assessments, (DTIAs) for any restricted transfers of personal data that rely upon SCCs that they make to other countries outside of the EEA, for example: Australia, Singapore etc.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Does your DPA and Sub-Processor List need updating?

Meta were fined 1.2 billion Euros for breaches of EU data protection law and for transferring personal data of EU users to the US despite, using standard contractual clauses, (SCCs), having in place supplemental measures and carrying out data transfer impact assessments, (DTIAs). Google has also been pursued in various EU member states for similar breaches.

In light of these decisions, SaaS suppliers should review their own data protection practices and documentation to ensure that they are up to date and comply with the current rules.

Use of the correct SCCs

New EU SCCs

Since the 27th of December 2022 the new EU SCCs must be used for all transfers of EU personal data to a third country. Any SaaS agreements that still include the old EU SCCs must be updated to include the new EU SCCs.

New UK SCCs

All SaaS agreements concluded on or before the 21st of September 2022 must use the new UK SCCs.

SaaS suppliers and SaaS customers can only continue to use the old EU SCCs in existing SaaS agreements until the 21st of March 2024 provided that the processing operations that are the subject matter of the agreement remain unchanged.

Supplemental Measures

In addition to using the correct, and up to date SCCs, SaaS suppliers must carry out due diligence on any sub-processors they plan to use to process personal data, where the sub-processors rely upon SCCs to transfer personal data outside of the EEA. Details of the supplemental measures used must be included in the sub-processor list.

The only supplemental measures that are compliant with the European Data Protection Board, (EDPB) guidelines are:

  • Encryption of data at rest and in transit; and
  • Storage of encryption keys within the EEA.

Data Impact Transfer Assessments

Following the Schrems II decision, the court made clear that SaaS suppliers and SaaS customers must carry out and document data transfer impact assessments when using SCCs as a transfer mechanism for restricted transfers.

SaaS suppliers should check their Article 30 GDPR data mapping document to identify which sub-processors rely upon SCCs, then they must;

  • Carry out a Schrems II data transfer impact assessment, for each transfer from the EU;
  • Carry out an ICO data transfer assessment for each transfer from the UK, (DTA) using the ICO tool or using an EU DTIA.

Summary

When reviewing compliance with the above rules SaaS suppliers and SaaS customers should not just check their SaaS agreements with customers. They will also need to review existing group data transfer agreements and existing agreements and DPAs with all third parties, i.e. suppliers, resellers, partners and sub-contractors.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here