News|Newsletter
GDPR: Data Transfers
Once upon a time data transfers…
March 16, 2021
The notion of “data transfer” is not defined in the General Data Protection Regulation (GDPR). Even though, from a Regulation perspective, a broad definition may result from the interpretations and clarifications of the authorities (European Data Protection Board “EDPB” and National Data Protection Authorities “DPA”).
MyData-TRUST took the time to deeply analyse the topic and summarised all the information you should know in this Article.
Data Transfer Rules
Since the subject of data transfers has become more complex these last years, it has become essential to use the correct transfer tools and to know how to apply them. Moreover, the recent Privacy Shield’s invalidation was a clear warning sent by the European Court of Justice to clarify data transfer rules.
Following the Schrems II ruling, the EDPB released Guidelines on additional measures that need to be put in place to secure a data flow: a mechanism of transfer such as a contract between two entities is not sufficient because it shall not bind Authorities. Supplementary measures of data protection are often essential, whether technical, organizational and contractual. In parallel, the EU Commission drafted a provisional version of new Standard Contractual Clauses (“SCCs”), one contractual method of transfer based on templates. Initially elaborated in the early 2000s (before the GDPR!), it was about time to adapt them to the realities of the world…
Are the new draft SCCs the remedy to address the challenges we are facing?
The answer is not certain. If we take a closer look at the EU Commission’s new version of the SCCs, it is clear that there are challenges that need to be addressed. Two main conclusions can be drawn from this:
- lack of scenarios: four modules are now taken into consideration to cover more situations than in the current version. The idea is that the company will pick the module adapted to its situation at stake. Especially, the modular approach developed raises other questions in terms of responsibilities for such processors, specifically to the exporters as the SCCs impose strong obligations on them.
- lack of flexibility: it remains a concern. Although the appearance of the “docking clause” would allow any interested party to adhere to the content of one single set of SCCs by completing the annex, we wonder about its uses given the multiplicity of roles and data processing activities that may entail data flows.
Finally, this long-awaited revision of SCCs will not overcome all issues with data transfers in the clinical trial sector. We may have to learn to live with them as we do not expect significant changes to the drafts published by the Commission.
Your DPO at MyData-TRUST is available to support you with Data Transfers.
If you have any questions regarding the scope, the Data Protection Representative, the Competent Supervisory Authority or about Data Transfers, please contact us. MyData-TRUST team will put all their efforts to support and sustain your activities involving personal data.
