EU-UK Adequacy Decisions Finalized

June 30th, 2021 | Posted by Claude-Etienne Armingaud in Brexit | Data Transfer | Privacy - (0 Comments)

On 28 June 2021, within 48 hours of the expiration of the post-Brexit grace period under the UK-EU Trade and Cooperation Agreement, the European Commission has adopted two adequacy decisions addressing the transfers of personal data to the United Kingdom under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive, respectively (together, the UK Adequacy Decisions).

Both texts prohibit the transfer of personal data to “third countries” unless (a) the destination country benefits from (i) an adequacy decision or (ii) appropriate safeguards, such as standard contractual clauses (see our alert here) or codes of conduct (see our alert here); or (b) one of the limited derogations under Article 49 GDPR applies.

The UK Adequacy Decisions will allow a seamless flow of personal data between the United Kingdom and the European Union, concluding a six-month race against time (see our alert here).

Key Points to Note:
  1. Despite the severe concerns raised by the European Data Protection Board in its Opinion 14/2021, due to the United Kingdom’s national security, intelligence, and surveillance regime, the European Commission deemed that the United Kingdom provided for “strong safeguards” in relation to access to personal data by public authorities for national security reasons. 
  2. The European Commission will closely monitor any evolution in the UK data protection framework that would lead to divergence with the EU regulations. This is particularly relevant because the United Kingdom announced it could revise its privacy framework for a more liberal approach in the coming months (see the Final Report from the Task Force on Innovation, Growth and Regulatory Reform), foreshadowing the UK government’s National Data Strategy, currently under consideration. As such, the European Commission may intervene at any given point to repeal the UK Adequacy Decisions.
  3. The UK Adequacy Decisions are subject to a sunset clause, i.e., unless expressly renewed, based on a new assessment of the UK regulatory framework, the UK Adequacy Decisions will expire in four years. This is markedly a different process from prior adequacy decisions, which typically renew by default without any need to go through a new review and adoption process. The addition of the sunset clause seems to suggest that the United Kingdom’s cards have been marked, and if the relationship between the United Kingdom and the European Union deteriorates in the next few years, this could mean the end of EU-UK adequacy at that time.
  4. For the time being, any personal data transfers relating to UK immigration control are excluded from the scope of the UK Adequacy Decisions, pending remediation under UK law.
  5. While the United Kingdom now belongs to the increasing group of third countries benefiting from an adequacy decision (including Japan and the Republic of Korea), it does not relieve companies subject to the UK data protection framework from the requirement to appoint an EU representative under Article 27 GDPR or, similarly, for EU companies subject to the UK GDPR to appoint a representative in the United Kingdom.

The firm’s global data protection team (including in each of our European offices) remains available to assist you in achieving the compliance of your data transfers at global levels.

First publication: K&L Gates Hub in collaboration with Sunny J. Kumar, Noirin M. McFadden, Keisha Phippen

A New Framework for Transfers of Personal Data EU and Korea Conclude Adequacy Decision Talks

June 25th, 2021 | Posted by Claude-Etienne Armingaud in Data Transfer | Europe | Privacy | World - (0 Comments)

BACKGROUND

On 30 March 2021, the European Commission, in a joint statement with the Personal Information Protection Commission, the data protection authority of the Republic of Korea (Korea), declared that Korea ensured a level of protection for personal data that is similar to the level provided in the European Union (the EU) and, as such, is a jurisdiction deemed “adequate.” Further to this joint declaration, the European Commission completed its internal procedures and formally adopted the substance of this joint statement in a draft adequacy decision published on 14 June 2021. Once finalized, businesses will be allowed to transfer personal data freely from the EU and European Economic Area (EEA) to Korea without being required to provide further safeguards as required for “third country transfers” under the EU General Data Protection Regulation 2016/679 (GDPR). Once so adopted, the adequacy decision would cover transfers of personal data to commercial operators located in Korea, as well as Korean public authorities. However, the transfer of personal credit information that is subject to jurisdiction of Korea’s Financial Services Commission will be excluded from the coverage of the adequacy decision.  

The adequacy decision only relates to the transfer of personal data from the EU/EEA to a recipient in Korea, but it does not cover the general applicability of GDPR. In this context, any company (even outside the EU/EEA) that directly collects personal data from EU residents in connection with offering goods or services or monitoring of behavior of EU residents will still need to comply with the obligations set out in the GDPR for its collection of personal data. Also, significantly, the adequacy decision only covers data flow in one direction, from the EU to Korea, but not in the opposite direction, i.e., from Korea to the EEA. As noted below, barring any further statutory amendments, Korean privacy laws still require data handlers to obtain the consent of data subjects (as opposed to an opt-out) prior to transferring their personal data outside of Korea.

The conclusion of adequacy talks between Korea and the European Commission is a major step in their ongoing four-year dialogue regarding mutual recognition of personal data protection regimes. Korea has been preparing for this adequacy decision since 2015, when the Korean government established a joint public-private sector task force, which was charged with conducting data regulation-related feasibility studies, self-assessments, and comparative analyses in preparation for the first round of adequacy negotiations with the EU in 2017. After two extensive rounds of adequacy negotiations between the representatives of the European Commission and Korea ended without an adequacy finding, Korea decided to make significant amendments to its data protection laws. Such amendments were enacted by the National Assembly, Korea’s national legislature, in January 2020 and became effective in August 2020, thus paving the way for the March 2021 joint statement.

(more…)

, , , , ,

GDPR – Data Transfers 2.0: Navigating Through Post-Schrems II Waters

June 11th, 2021 | Posted by Claude-Etienne Armingaud in Data Transfer | Europe | Privacy | World - (0 Comments)

Depending on whether you are an optimist or a pessimist, it will have taken the European Commission either three years and two weeks (since the entry into force of the General Data Protection Regulation (GDPR) or eleven months (since the Schrems II decision — see our Alert here) to publish its finalized revision of the most flexible tool to allow for the transfer of personal data to partners located in countries not otherwise providing an adequate level of data protection (Adequate Countries): the Standard Contractual Clauses (SCCs).

While Schrems II made headlines with its cancellation of the Privacy Shield framework, this mechanism only affected 5,000 companies in the United States. SCCs, on the other hand, remain the most widely used instrument to ensure an end-to-end sufficient level protection of personal data covered by European data protection. With their original version dating back 2001, an update was severely needed to align them with GDPR’s extensive reach and requirements.

IN A NUTSHELL:

  • The new SCCs were published on 4 June 2021:
    • Starting on 27 June 2021, companies will need to transition to the new SCCs;
    • On 27 December 2022, companies must have finalized their transition to the new SCCs.
  • Affected companies include:
  • Key new elements include:
    • Data exporting entities will need to assess the importing countries’ regulatory framework;
    • Where such framework cannot safeguard the transferred data subject to GDPR, additional measures must be implemented contractually, organizationally and/or technically;
    • Each and every step of the assessment, and the relevancy of the remediation measures, must be thoroughly documented; and
    • In the case of a controller/processor/sub-processor relationship, the new SCCs consolidate the requirements into a single agreement addressing the data processing requirements under Article 28 GDPR and the data transfer agreement.
  • While the new SCCs provide for a general framework, many issues are left to:
(more…)

, , , , ,

Legal 500 Rankings 2021 – Industry focus: IT, telecoms and the internet – Band 4

April 15th, 2021 | Posted by Claude-Etienne Armingaud in IT | Privacy | Rankings - (0 Comments)

Practice head(s): Claude-Etienne Armingaud

Testimonials

‘Skilled technical lawyers with excellent industry knowledge.‘

‘Claude-Étienne Armingaud possesses excellent technical legal skills with a sensible practical commercial approach which comes through unrivalled knowledge of the sector.‘

‘Claude-Étienne Armingaud is the best at what he does, plain and simply.

(more…)

, ,

Claude-Etienne Armingaud Recognized as Leading Individual for Data Protection by Legal 500 – 2021

April 15th, 2021 | Posted by Claude-Etienne Armingaud in Privacy | Rankings - (0 Comments)

Source: Legal 500

, ,

Legal 500 Rankings 2021 – Data Privacy and Data Protection – Band 2

April 15th, 2021 | Posted by Claude-Etienne Armingaud in Privacy | Rankings - (0 Comments)

With notable experience in the implementation of GDPR compliance and data protection, the team at K&L Gates LLP coordinates with the firm’s wider European practice to act for multinational clients in the luxury goods, entertainment, and telecoms sectors. Practice head Claude-Etienne Armingaud frequently acts for fintech clients in contentious multi-jurisdictional matters regarding IP and IT data protection. In March 2020, associate Clara Schmit joined from D’Alverny Demont Associés.

Practice head(s): Claude-Étienne Armingaud

Other key lawyers: Clara Schmit

Testimonials

‘Claude-Etienne Armingaud is the best at what he does, plain and simply. Fast, reliable, and efficient.’

‘A team which is very familiar with the evolution of the regulatory framework applicable to data, and which has often participated in the work of developing new guidelines with the CNIL.’

‘Claude-Etienne Armingaud is very familiar with the issues of data protection and privacy. He supports a large clientele in various fields of intervention.’

(more…)

, ,

Sapin II – What Recommendations Should Be Followed From 2021 Onwards

April 12th, 2021 | Posted by Claude-Etienne Armingaud in France | Privacy - (0 Comments)

The French Law n°2016-1691 of 9 December 2016 relating to transparency, the fight against corruption, and the modernization of economic life, known as the “Sapin II” Act 1)Sapin II entered into force on 10 December 2016 (JORF n°0287 of Dec. 10, 2016) introduced to legal entities additional compliance requirements to address corruption in order for France to meet the highest European and international standards.

Sapin II has established a general principle of prevention and detection of corruption risks under the control of a national anticorruption structure, the French Anti-Corruption Agency (AFA),  whose main mission is to help economic and public players in the process.

The AFA noted in its 2019 annual activity report 2)French Anti-Corruption Agencyn Annual Activity Report 2019 (7 July 2020) (in French).that anticorruption measures implemented by economic and public players were still incomplete.

On 12 January 2021, the AFA published new recommendations entered into force on 13 January 2021 (Recommendations, here in French).

The AFA specifies the practical procedures for implementing an anticorruption system structured around three foundational principles, namely:

  • Governing body’s commitment;
  • Understanding the entity’s exposure to probity risks; and
  • Risk management.
(more…)

References

References
↑1 Sapin II entered into force on 10 December 2016 (JORF n°0287 of Dec. 10, 2016)
↑2 French Anti-Corruption Agencyn Annual Activity Report 2019 (7 July 2020) (in French).

, , ,

German Supervisory Authority Initiates-Post-Schrems II Enforcement Against EU Companies Using U.S. Service Providers

April 2nd, 2021 | Posted by Claude-Etienne Armingaud in Data Transfer | Europe | Privacy - (0 Comments)

Since the Schrems II decision of the Court of Justice of the European Union (CJEU) last year (see our alert here), companies in the European Union found themselves between a rock and a hard place, as many still rely on U.S.-based online service providers in one capacity or another, and the CJEU, in addition to totally invalidating the Privacy Shield framework, mandated additional requirements over the Standard Contractual Clauses (SCCs), the most widely used lawful transfer mechanisms.

Following this CJEU decision, the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht) has now effectively barred a European online magazine from using the popular U.S.-based newsletter delivery service, Mailchimp.

Companies using Mailchimp to route their newsletters must generally transfer personal data (e.g., the recipients’ email addresses) to Mailchimp’s servers in the United States. Previously certified under the late EU-U.S. Privacy Shield framework, Mailchimp had to pivot to offer its European customers an alternative transfer mechanism, i.e. the SCCs. While their general validity was left untouched by the Schrems II decision, the CJEU argued that it may be required for companies relying on the SCCs to assess whether additional safeguards should be implemented on top of the SCCs in order to effectively protect personal data.

As expressly mentioned in the Schrems II decision, transfers to cloud service providers in the United States would require such additional safeguards, due to the broad investigative powers of U.S. authorities, e.g., under Section 702 (50 U.S.C. § 1881a) of the Foreign Intelligence Surveillance Act (Cloud Services Act).

Until now, it had seemed that the EU supervisory authorities had granted companies an unofficial grace period to adjust to the amended legal situation, especially as new templates for SCCs taking into consideration the Schrems II decision are expected to be finalized in the coming weeks.

The action of the Bavarian Data Protection Authority shows that this restraint might have come to an end. In a recent press release concerning this investigation, the authority commented that the case was exemplary for their enforcement of the requirements of the Schrems II decision, which had already been taken up with a high degree of intensity even without publicly perceived investigations or sanctions. 

The Bavarian Data Protection Authority based its action expressly on the fact that the European company has not assessed whether additional safeguards for transferring personal data to Mailchimp were required, in particular as Mailchimp may be subject to the Cloud Services Act. While no fine was imposed in this case and the Bavarian Data Protection Authority did not issue a formal decision, the authority still informed the company that their use of Mailchimp was (in their view) not in line with General Data Protection Regulation (GDPR) requirements. The company also promised to cease using Mailchimp in the future.

However, it should be noted that the official reason for not imposing a fine was on the one hand, the low sensitivity of the data transferred (email addresses only) and, on the other hand, the limited scope of the transmission (only two newsletters were sent). The details of the case being leaked and officially commented on by the supervisory authority could be considered as a warning to other EU companies transferring data to U.S. cloud service providers, which should probably expect less leniency from the supervisory authorities from now on. 

The current case was rather clear, as the European company in question has apparently taken no steps at all to establish and document whether additional safeguards were required and were already (because of this omission) in breach of their statutory obligations under GDPR. Future cases will probably not be as easy to decide, in particular when an EU company has documented a respective assessment or even implemented additional safeguards, and supervisory authorities and ultimately courts will have to assess what is really required to ensure adequate security of personal data in countries outside the European Union. 

Following the decision of the Bavarian Data Protection Authority, EU companies using U.S. online service providers, especially cloud services, are therefore encouraged to check the basis of their data transfers to the United States and, if necessary, adapt them to the new legal situation in order to avoid facing potentially high fines. 

K&L Gates’ global data protection team (including in each of our European offices) remains available to assist you in achieving the compliance of your data transfers at global levels.

First Publication: K&L Gates with Thomas Nietsch & Martin Fokken

, , , , , ,

Leaders League Rankings 2021 – Technologies, internet & telecommunications – Data protection law – Law firm – France

March 14th, 2021 | Posted by Claude-Etienne Armingaud in Privacy | Rankings - (0 Comments)

K&L Gates ranked “Highly Recommended – Band 1” with Claude-Etienne Armingaud.

Source: Leaders League

, ,

GDPR/Data Scraping – A Clear Limitation by the French Data Protection Authority to Direct Marketing Practices

March 10th, 2021 | Posted by Claude-Etienne Armingaud in eCommerce | France | Privacy - (0 Comments)

The French Supervisory Authority (CNIL) wrapped up 2020 with a EUR 20,000 fine against NESTOR, a French food preparation and delivery company catering to office employees (see full Decision SAN-2020-018 in French).

The CNIL highlighted various breaches of the General Data Protection Regulation (GDPR) and the ePrivacy Directive regarding the processing of prospects and clients’ personal data by the CNIL, most notably:

While the fine is rather limited in view of the maximum potential amount of EUR 20 million or four percent of the turnover (whichever the greater), this decision presents an opportunity to examine web scraping and direct marketing practices, which are rapidly developing.

(more…)

, ,