Author: Konstantin Tiazhelnikov

Allocating roles within a group of different actors might often become very difficult, in particular when drawing a line between joint decisions and separate ones gets tricky.

Say that a parent company offers its subsidiaries to use a new uniform online platform for the processing of orders placed by customers entering into a supply contract with a subsidiary. There are at least two actors here, so how to properly allocate roles here?

‘Guidelines’ intend to provide for some new tips helping to spot a joint controllerships in paragraphs 3.2.2.1, 3.2.2.2, but all of them still revolve around what has always been clear from Article 26: finding out how means and purposes of processing are defined requires careful case-by-case assessment. To that end, ‘Guidelines’ are more likely to be expected to outline a clear methodology of how this assessment should be performed.

Referring to the question above, e.g., it might revolve around questions like: does the parent company make it mandatory for the subsidiary to use the online platform (and thus it solely defines means and purposes)?; or can the platform only be used in case of a common decision of the parent company and the subsidiary to do so?

Instead of the methodology, we can (not only but mostly) see examples. Examples are always good but they are rarely helpful when factual picture in practice differs (even slightly) from that described in the example. In other words, examples contain an analysis of very specific facts alone, while a privacy pro needs an understanding (method, checklist, etc.) of how to properly approach every possible set of facts.

Good job, EDPB, but could you please try again?

Organizing your data transfers to 3rd countries in a post-‘Schrems II’ world might become a truly daunting task. But what should definitely be avoided? Learn from this short video.

Why I think so? It stems from a superb article written by the IAPP authors who skilfully and clearly explain (for the first time ever?) how to tackle the issues raised in the CJEU’s decision and to continue data transfer to USA based on supplemented SCC (see the link below).

Just take a deeper look and see how many details of the US laws are taken into account and analysed, based on which practical recommendations are given. At the same time, the CJEU factually introduced the requirement to evaluate legal landscape in every third country that imports data flows.

The above means that the same exercise should be conducted in relation to each third country. In many of them the laws may not even be translated in English and be publicly available, case law may indeed be unclear or even absent. Such analysis will almost definitely require a great deal of time and money amid the absence of grace period. 

Where to get help:

1. See my short article on how to start with the assessment without spending budget: https://www.linkedin.com/posts/tiazhelnikov_two-money-saving-starting-points-on-how-to-activity-6696105568085561344-qJFl
2. See Essential Guarantees Guide (https://www.essentialguarantees.com) which can help you analyse surveillance practices in different countries across the globe.
3. Expect more from me on that issue in the following weeks as we at Carlsberg HQ are launching «Schrems II Working Group» to share thoughts and develop action plan.
4. Remember that ‘wait and see’ approach is not an option here; complexity is not an excuse for doing nothing in the hope that Supervisory Authority will wait too. 

It’s been more than two weeks since CJEU announced its ‘Schrems II’ decision, introducing the requirement to evaluate legal landscape in third countries (those of data importers) and put additional safeguards in place, as necessary, – even if the data are transferred to other than USA third countries based on SCC or BCR. FAQ issued by EDPB on 23 July probably left more questions then answers.

Since then, media space has been overwhelmed with various guidances, legal digests and discussions about how to make assessment and what safeguards can be put in place.

The truth is, as of now, nobody really knows 100% workable answers. From FAQ issued by EDPB we know that “it is the responsibility of the data exporter and the data importer to assess whether the level of protection required by EU law is respected in the third country concerned in order to determine if the guarantees provided by the SCCs or the BCRs can be complied with in practice”. 

However, below are two tips on how begin with the assessment without engaging reputable law firms with exorbitant prices.

1. It comes from the EDPB FAQ itself – contact your data importer and ask for collaboration with regard to the assessment. E.g. require data importers to state whether public authorities in their countries are entitled to have an access to personal data and on which conditions; whether the data importers are under a legal obligation to make personal data available to public authorities for any purposes.

2. Conduct your own assessment using WP237 (‘Working Document 01/2016 on the justification of interferences with the fundamental rights to privacy and data protection through surveillance measures when transferring personal data (European Essential Guarantees)’) issued by Working Party 29.

In this document, WP29 identified 4 Essential Guarantees to be taken into account for all data transfers to third countries:

A. Processing should be based on clear, precise and accessible rules;

B. Necessity and proportionality with regard to the legitimate objectives pursued must be demonstrated;

C. An independent oversight mechanism should exist;

D. Effective remedies need to be available to the individual.

At least two of them were used by CJEU when invalidating Privacy Shield. Are all of them respected in the country of your data importer?

Will the above work? Not really a fact. As they say, the answers are hopefully yet to come soon. At least, this can help you understand a general landscape prior to signing a legal service supply contract with a law firm. 

EEGG focuses on governmental measures aimed at surveillance, interception of communications, access to personal data and storage thereof by public authorities in different countries.

EEGG provides non-binding assessment by expert contributors worldwide of compliance with ‘European Essential Guaranties’ (summarized by the Working Party 29, the European Data Protection Board predecessor) and subsequent European Court of Human Rights case law.

The link is below:

https://www.essentialguarantees.com

As you may note, some countries are still waiting for their expert contributors, so feel free to join the project and contribute!