The European Data Protection Board (EDPB) has issued draft guidance on the interplay between the application of the EU General Data Protection Regulation's (GDPR's) territorial scope provisions and rules on international transfers for consultation. The consultation closes on 31 January 2022.
The guidance is particularly relevant to any organisations that are subject to the EU GDPR and that transfer personal data internationally.
The guidance explains that the following three elements are required for there to be a transfer of personal data to a third country or to an international organisation:
- a controller or a processor is subject to the GDPR for the relevant processing;
- this controller or processor (exporter) discloses by transmission or otherwise makes personal data, subject to the processing, available to another controller, joint controller or processor (importer); and
- the importer is in a third country or is an international organisation. The guidance clarifies that this element applies irrespective of whether the importer is subject to the EU GDPR in respect of the relevant processing in accordance with article 3.
This guidance is noteworthy in that it clarifies that a transfer will take place, even if the importer is subject to the EU GDPR (pursuant to article 3(2)) – a query discussed here.
Recital 7 of the new EU standard contractual clauses (SCCs) specifies that the clauses can only be used if the importer is not subject to the EU GDPR. Where an importer is subject to the EU GDPR (pursuant to article 3(2)) but based in a third country, an appropriate safeguard is required to protect the transfer of personal data. However, there are no official SCCs currently available to address this. The guidance confirms that any safeguard implemented to cover this scenario should be adapted so as to avoid duplication of the EU GDPR obligations and instead address the elements and principles that are missing. It is possible that a set of specific clauses covering this scenario will be released by the European Commission in due course. In its guidance, the EDPB says it "encourages and stands ready to cooperate in the development of a transfer tool, such as a new set of standard contractual clauses" in this regard.
For further information on this topic please contact Lizzie Charlton or Philip James at Eversheds Sutherland by telephone (+44 20 7919 4500) or email ([email protected] or [email protected]). The Eversheds Sutherland website can be accessed at www.eversheds-sutherland.com.