'Most Innovative Startup 2020' by RSA - Watch the pitch videoView More
Things are getting serious for 101 EU data controllers sending data to the US – Max Schrems’ organization “NOYB” lodges complaints with various EU authorities
One month ago, the Court of Justice of the European Union (CJEU) delivered its "Schrems II" ruling (16 July 2020, C-311/18), thereby declaring the EU-US Privacy Shield invalid. Although the CJEU found the standard contractual clauses (SCC) remain valid, it pointed out that the formal conclusion of the SCC alone may not be sufficient to safeguard data transfers to so-called “third countries” outside the EU, particularly the US. Rather, the data exporter and data importer must ensure that the data is granted the same protection in the third country as it is within the EU under the GDPR and the EU Charter of Fundamental Rights.
Max Schrems, the defendant in the proceedings which formed the basis for the Schrems II judgment, directly responded to the judgment. On his not-for-profit organization’s (NOYB – European Center for Digital Rights) website, he provided sample inquiries for companies as well as data subjects, which they can send to data processors and data controllers. The templates are used to request information on how the respective companies secure the transfer of data to third countries following the judgement.
Now the organization has filed 101 complaints with the relevant supervisory authorities against EU controllers that use Google Analytics and Facebook Connect integrations on their webpages. The affected controllers include large international companies from various business sectors. The complaints are identical in content. NOYB argues that the use of the Google and Facebook services requires the transfer of personal data to the USA. The parties, however, failed to implement adequate safeguards when continuing to transfer data to the US. Based on these arguments, NOYB requests that the authorities fully investigate the complaint and immediately impose a ban or suspension of any data transfers from the data controllers to Google and Facebook in the US and order the return of such data to the EU or another country that provides adequate protection. In addition, the supervisory authorities shall impose fines on the data controller as well as Google and Facebook.
It remains to be seen how the supervisory authorities deal with the complaints. Given their individual responsibilities, there is no obligation for the various EU regulators to develop a coordinated consolidated approach. Instead, it is possible that there will be different reactions from the authorities in the individual proceedings: In their initial comments, the supervisory authorities had expressed very different views on the Schrems II judgment. While some authorities stated that a transfer to a third country based on SCC alone was considered inadmissible, others took a much less strict view. The varying opinions will probably also be reflected in the responses to the complaints.
In any case, the complaint procedures and the resulting reactions of the supervisory authorities may serve as a guideline for other controllers and processors as to which measures must be taken in future to lawfully transfer data to third countries, especially the US.
With the increase in digitalization and its impacts on the globe, a new wave of data privacy laws has emerged. Countries all across the world are increasingly acknowledging the need for the protection of personal information in the digital space and formulating their laws based on the framework set up by the European Union’s General Data Protection Regulation (GDPR).
The GDPR in its current form serves as a beacon of hope, providing many rights to individuals with respect to the protection of their personal data and imposing realistic obligations upon corporations that collect and process their data. While the GDPR is a commendable effort by the European Commission, it has to be read together with the Directive 2002/58/EC on privacy and electronic communications that predates the GDPR by 14 years; the e-Privacy Directive (e-PD).
Both e-PD and GDPR reflect the principle of the protection of personal information as an individual’s basic right as enshrined under the EU Charter of Fundamental Rights. Together with the e-PD and the GDPR, the European Union offers the strongest data protection legal framework currently in the world. With the e-PD being changed to reflect the problems of the modern day, it is very important to understand its history and what changes are being contemplated.
The e-PD applies to “the processing of personal data in connection with the provision of publicly available electronic communications services in public communication networks in the community”. This means that the e-PD regulates all publicly available electronic communications services and telecommunication services irrespective of the technologies used.
Under the Directive, service providers are required to take appropriate technical and organizational measures to ensure confidentiality of communications, safeguard the security of their services and inform the subscribers of any special risks arising out of the breach of security of the network.
The objective of both the GDPR and the e-PD is to ensure an appropriate level of security and confidentiality of data and communications of European Union residents. However, the matters that fall under the subject matter domain of one regime are outside the scope of the other. This is clarified in Recital 173 and Article 95 of the GDPR, according to which, the GDPR does not apply where there are already existing e-Privacy rules.
Despite having two separate applicability areas, there may be some overlap and, in that situation, both GDPR and e-PD must be read together.
Corporations that send electronic marketing including email advertising in the European Union must comply with the requirements of both GDPR and e-PD. The e-PD requires service providers to obtain the consent of data subjects before processing their data for marketing. This includes an obligation upon corporations to provide full and accurate information to data subjects about the types of processing they intend to perform, their rights to not give consent and withdraw consent. The e-PD also grants subscribers protection against unsolicited communications for direct marketing purposes.
Similarly, the GDPR provides data subjects the right to object to data being processed for direct marketing purposes including an objection to profiling. The GDPR clarifies that in the context of the use of information society services, i.e. services delivered over the internet, the data subject may exercise his or her right to object by automated means using technical specifications, notwithstanding anything contained in the e-PD.
The e-PD was originally known as the “cookie law” because it provides specific rules on cookies, unlike the GDPR. As per the e-PD, organizations must provide clear and comprehensive information to users in relation to the processing of cookies and must acquire informed consent of users before tracking with cookies. The two exceptions to this are “where technical storage or access is for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user”. Under the e-PD, users must have the opportunity and the right to refuse to have a cookie stored on their terminal equipment.
Although the GDPR does not specifically mention cookies, it classifies cookie identifiers as a type of “online identifier” meaning that it may be considered personal data under certain circumstances. The GDPR further requires controllers and processors to demonstrate that the data subjects have consented to the processing of their information and that there must be some lawful basis for the processing of data subjects’ personal information.
The e-PD will soon be replaced by the e-Privacy Regulation (e-PR) that is currently in its draft stage and under review by the European Union. The e-PR is expected to complement the GDPR just like the e-PD but will be an updated version which will be more in line with the industry-wide technological changes that have taken place in the last few years.
The proposed e-PR will not only provide protection to the content of European Union residents’ electronic communications but it will also stop the transfer and use of metadata associated with that communication. Therefore, e-PR is expected to update e-PD by ensuring confidentiality in all current and future means of communications including telecommunication services over the internet, emails, internet phone calls, personal messaging services through social media, voice services and other interpersonal communication services.
Having revised rules on cookies, the e-PR will allow users to refuse the tracking of cookies by being in control of the privacy settings. Furthermore, no consent shall be required for “non-privacy intrusive cookies”. The e-PR provides protection against any form of unsolicited electronic communications including spam.
This new law will have potentially significant effects on corporations especially those that use metadata or tracking tools to monitor online behavior. The e-PR has adopted the same standard of “consent” as that of the GDPR. Similarly, it has adopted identical penalties as that of the GDPR. Any violation of the regime will be subject to the same upper limit administrative fine, i.e. 20 million euros or four percent of the company’s total worldwide annual revenue, whichever is greater.
The e-PR is expected to update the existing outdated regime of the e-PD into a modernized one. It protects end-user’s privacy by ensuring their consent to the storage and access to stored data in their terminal equipment to avoid unwanted tracking cookies. It is in fact, a part of the comprehensive reform process of the European Union in relation to data protection and privacy laws.
Unlike its predecessor e-PD, the e-PR will automatically be applied to all member states across the European Union since it is self-executing and would not be requiring local domestic regulations by member states to be passed for its implementation.
SECURITI.ai is an innovator of AI-Powered cybersecurity and data protection solutions. Its product is the world’s first PrivacyOps platform that helps automate all major functions needed for privacy compliance in one place.
The SECURITI.ai’s Data Subject Rights Module is an automated system that drastically simplifies the process of fully complying with data subject rights requests.
The Data Mapping Automation Solution helps customers transition smoothly from their existing manual processes to a modern automated framework with minimal disruption and tracks personal data in structured and unstructured data stores to connect it to users. It enables companies to demonstrate compliance with privacy regulations.
The SECURITI.ai’s Consent Management Tool automates the consent lifecycle, enabling organizations to keep trust with individual customers in the processing of personal information.
The Assessments Module enables the evaluation of the readiness of a company's internal departments and divisions and measures the organization’s strengths against data privacy regulations.
The Vendor Assessments applies powerful automation to privacy assessment collection from third-parties and power analytics to yield deep insight into third-party compliance with privacy regulations.
SECURITI.ai helps businesses discover data over a web of internal and external systems, stitch a data graph to link personal data with each individual, conduct an automated internal assessment of policies as well as third-party vendors, manage consent and do a lot more.
Ask for a DEMO today to understand how SECURITI.ai can help you comply with GDPR, e-Privacy Directive, and a whole host of other global privacy laws and regulations, such as the CCPA, with ease.
In a major upset, the Court of Justice of the European Union (CJEU) in Data Protection Commissioner v. Facebook Ireland Limited, Maximilian Schrems (Case C-311/18) (or colloquially referred to as Schrems-II in the privacy community) invalidated the Privacy Shield arrangement between the European Commission and the United States on July 16th 2020, bringing billions of dollars of transatlantic trade and transfer of data into uncertainty and question.
This is not the first time such a situation has been created. A similar outcome was seen back in 2015 (referred to as the Schrems-I decision) when Safe Harbour, an earlier privacy framework agreement between the Commission and the US was struck down by the CJEU for being an inadequate protection framework for the transfer of European citizens’ data to the United States.
The reasoning by the CJEU back then to invalidate Safe Harbor was very much similar: US laws allowed intelligence authorities to access the transferred data unfettered and the lack of a legal recourse for European citizens to exercise their data rights under the GDPR and EU charter on Fundamental Rights.
The difference between then and now is how the CJEU also discussed the Standard Contractual Clauses - SCCs, another popular transfer mechanism used by many entities to transfer European citizens’ data to a huge host of third parties in various countries. The CJEU generally upheld the SCCs but created a whole new set of considerations for companies to consider when dealing with transfer of data of European citizens outside the EU zone.
Given the diplomatic, political and legal implications of the judgement, it is safe to say that Schrems-II will be the subject of much discussion in the coming weeks in not only the privacy professional circles but also between global leaders and the internet industry. Thus it is important to understand what the Luxembourg court held and why and what seems to be the path going forward.
This case began with Mr. Maximilian Schrems, a citizen of Ireland and digital privacy activist, who complained to the Irish Data Protection Commission (DPC) that Facebook Ireland (a regional headquarters of Facebook Inc. a silicon valley company in the US which runs arguably the most popular and biggest social media website in the world called Facebook) should not be allowed to transfer his data to its US parent.
Shrems worried that the US mass surveillance programs - which have become public knowledge after Snowden’s revelations in 2013 - indiscriminately and in a disproportionate manner violate the privacy rights guaranteed to him under the GDPR and the EU charter on Fundamental Rights as the current protection mechanisms in place by the European Commission which allows the data to be transferred from Europe to the US (i.e back then the Safe Harbor mechanism and the Standard Contractual Clauses) are inadequate in protecting his rights and providing him a remedy.
The CJEU struck down Safe Harbor in Schrems-I and sent the case back to the Irish DPC for further proceedings. Mr. Schrems amended his complaint to include the SCCs and the newly made Privacy Shield, and the Irish DPC referred the case to the Irish High Court, which, after hearing from Facebook, US authorities and other parties, referred legal questions back to the CJEU for a final decision.
The legal questions sent by the Irish High Court to the CJEU specifically scrutinized the legitimacy and adequacy of the European Commission’s decision to consider data transfers from Europe to the US under the Privacy Shield framework and the SSCs in light of Section 702 of Foreign Intelligence Surveillance Act and Executive Order 12333 which allow US intelligence services broad powers to conduct surveillance, intercept and collect data and leave little to no judicial redress to European citizens to challenge the interception by US intelligence agencies.
After conducting a thorough analysis, the CJEU answered the questions posited to it by concluding that the Privacy Shield protection mechanism was inadequate because:
The CJEU even considered the SCCs that are signed between entities in Europe and the United States for transfer of European citizens’ data and while it did not outrightly strike down this popular mechanism of data transfer, some important guidelines were provided and additional due diligence obligations on data controllers and processors were imparted. The CJEU has also tasked the Data Protection Authorities (DPAs) in the member states of the EU to step in and do the analysis if necessary and stop the transfer of European citizens’ data when required. The guidelines and obligations are dilated below:
Data controllers and processors signing SCCs with foreign based third party entities must see to it that the third party destination countries have laws and regulations which will sufficiently respect and enforce the SCCs by providing additional protections beyond the contractual provisions.
However, if the data controller or processor finds that the law and regulations of the third party destination country are contrary to the provisions of the SCCs and they will lead to the violation of the contractual terms and the rights of European citizens under the GDPR, the controller or processor is duty bound to stop the transfer of data immediately and have the third party entity delete the data as per the SCCs terms.
If the data controller or processor is slow to take action, it is the job of the member state’s DPA to step in and stop the transfer of data under the SCC and suspend all future transfers to that country under the SCCs until the laws and regulations are amended to provide greater protection.
Businesses transferring data from European entities must not panic. The industry has faced such an upset before with the invalidation of Safe Harbour in 2015. The transatlantic transfer of data has not screeched to a halt (the US is still certifying companies wishing to do data transfers under the Privacy Shield). The mechanism for transatlantic data transfer from Europe to the US has only entered uncertainty once again.
While data being transferred to the US under SCCs is under greater scrutiny and can be halted in the future by EU member state DPAs, the GDPR evisions more routes which allow for data transfer from GDPR protected jurisdictions to non-GDPR jurisdictions which do not have adequate domestic data protection frameworks. Consent of the consumer is certainly one option and so are certifications and corporate codes of conduct. These are options worthy of exploration by companies right now.
Many in the privacy community saw such a decision forthcoming and various possible solutions are already being considered right now. Even now, the US and European Commission are hard at work working out a new mechanism for transfer which is compliant with the CJEU’s judgement in Schrems-II. It would seem that with this judgement the pressure would increase on the United States to enact a GDPR-like all encompassing data privacy and protection federal law to counter the recurrent problems major Silicon Valley companies face due to a lack of a permanent adequate protection framework.
For businesses however, the bottom line is simple. Robust data privacy management is key. Voluntary adherence to GDPR standards is just good business sense nowadays. Expert compliance by companies all over the world to global data privacy regulations using specialized tools is the best way to avoid liabilities and carry on business without obstacles. This is where SECURITI.ai can help.
SECURITI.ai has an award winning privacy management solution based on an AI-powered PrivacyOps framework. It’s privacy management platform automates all aspects of GDPR compliance.
Ask for a DEMO today to understand how SECURITI.ai can help you comply with GDPR and a whole host of other global privacy laws and regulations, such as the CCPA, with ease.