Understanding GDPR in Cross-Border Data Transfers: Implications for Global Companies - Michael Edwards

The General Data Protection Regulation (GDPR) is a piece of landmark legislation that revolutionised data privacy rights for individuals in the European Union (EU). Its reach, however, extends far beyond the borders of the EU. Any global company that handles the personal data of EU citizens or residents must comply with GDPR, particularly its rules surrounding cross-border data transfers. In today’s digital world, where data flows effortlessly across geographical boundaries, understanding GDPR’s requirements for cross-border data transfers is crucial for any company with international operations. This article explores the core principles of GDPR, the specifics of cross-border data transfers, and what global companies need to do to ensure compliance.

Table of Contents

What is GDPR?

The GDPR came into effect on 25 May 2018, and its primary goal is to protect the personal data and privacy of individuals in the EU. The regulation applies to any organisation, irrespective of its location, that processes personal data of individuals within the EU. Personal data under the GDPR is broadly defined as any information relating to an identified or identifiable natural person, including names, addresses, email addresses, IP addresses, and more.

The GDPR gives individuals significant control over their personal data, including rights to access, rectify, delete, and transfer their data. It also requires companies to obtain clear consent for data processing and imposes strict rules on how data should be handled, stored, and transferred. Non-compliance with GDPR can result in heavy fines, up to 4% of a company’s global annual turnover or €20 million, whichever is higher.

Cross-Border Data Transfers Under GDPR

One of the most challenging aspects of GDPR for global companies is managing cross-border data transfers. According to GDPR, data transfers to countries outside the European Economic Area (EEA) – which includes EU member states and Iceland, Liechtenstein, and Norway – are only allowed under certain conditions. These provisions exist to ensure that the high level of data protection guaranteed by the GDPR is not undermined when data leaves the EEA.

Mechanisms for Cross-Border Data Transfers

To transfer personal data outside the EEA, companies must ensure that the destination country offers an adequate level of data protection. The GDPR outlines several mechanisms that companies can use to transfer data lawfully across borders:

Adequacy Decisions: The European Commission can determine that a third country offers an adequate level of data protection, meaning that data transfers to that country are permitted without further safeguards. Countries such as Japan, Canada (for commercial organisations), and the United Kingdom (post-Brexit) have received adequacy decisions. However, most countries do not have such a status.
Standard Contractual Clauses (SCCs): In the absence of an adequacy decision, companies can rely on SCCs, which are legal agreements between the data exporter and data importer that ensure the personal data is protected according to GDPR standards. The European Commission has updated SCCs to align with GDPR, and companies using them must conduct case-by-case assessments to ensure that data subjects’ rights are not undermined.
Binding Corporate Rules (BCRs): Multinational companies that frequently transfer personal data between entities within their corporate group can apply for approval of BCRs. These are internal rules that must be approved by a relevant data protection authority and ensure GDPR-compliant handling of personal data throughout the organisation.
Derogations: In certain limited circumstances, cross-border data transfers can be made based on specific derogations, such as explicit consent from the data subject, performance of a contract, or important reasons of public interest. However, these derogations should be viewed as exceptions rather than routine transfer mechanisms.

The Schrems II Case and Its Impact

In July 2020, the Court of Justice of the European Union (CJEU) issued a landmark ruling in the “Schrems II” case, which has had far-reaching implications for cross-border data transfers. The court invalidated the EU-US Privacy Shield, a framework that allowed data transfers between the EU and the United States, on the grounds that US surveillance laws did not offer sufficient protection for personal data. As a result, companies can no longer rely on the Privacy Shield to transfer data to the US.

The Schrems II ruling also raised the bar for the use of SCCs. The court held that companies relying on SCCs must assess, on a case-by-case basis, whether the law in the recipient country ensures adequate protection of personal data, particularly with respect to government access to data. If the recipient country’s laws do not offer sufficient protection, companies must implement additional safeguards or suspend the transfer.

This decision has created significant challenges for companies, especially those that rely on transferring data to the US or other countries without adequacy decisions. In response, companies have been forced to adopt a more proactive approach to assessing and mitigating the risks of cross-border data transfers.

Additional Safeguards for Cross-Border Transfers

In light of the Schrems II ruling, the European Data Protection Board (EDPB) issued guidance on supplementary measures that companies can use to protect personal data when transferring it to third countries. These measures can be technical, contractual, or organisational, and may include:

Technical measures: Encryption or pseudonymisation of data before transfer, ensuring that the data cannot be accessed or linked to an individual without additional information that remains within the EEA.
Contractual measures: Supplementing SCCs with specific contractual provisions that address the risks posed by the recipient country’s laws, such as commitments from the data importer to notify the data exporter of any government requests for data access.
Organisational measures: Implementing robust internal policies and procedures to limit access to personal data and ensure compliance with GDPR.

Companies must carefully assess the legal environment in the recipient country and determine whether these supplementary measures are sufficient to protect data subjects’ rights. If adequate protection cannot be ensured, the data transfer should not take place.

The Role of Data Protection Impact Assessments (DPIAs)

Under the GDPR, companies are required to conduct Data Protection Impact Assessments (DPIAs) when a proposed data processing activity is likely to result in a high risk to individuals’ rights and freedoms. Cross-border data transfers often fall into this category, especially when personal data is being transferred to countries without an adequacy decision.

A DPIA helps companies identify and mitigate the risks associated with cross-border data transfers. It involves assessing the nature of the data, the transfer mechanism being used, the risks posed by the recipient country’s legal environment, and any supplementary measures that can be put in place to ensure compliance with GDPR. Conducting a DPIA is a critical step in demonstrating compliance with GDPR and ensuring that individuals’ rights are protected.

Challenges for Global Companies

For global companies, managing cross-border data transfers in compliance with GDPR can be complex and resource-intensive. Some of the key challenges include:

Data Mapping and Inventory: To ensure compliance with GDPR’s cross-border transfer rules, companies must have a clear understanding of where their data is located, how it is being processed, and where it is being transferred. Conducting a comprehensive data mapping exercise is essential to identifying any cross-border transfers and ensuring that appropriate safeguards are in place.
Vendor Management: Many global companies rely on third-party vendors to process personal data, including cloud service providers, payment processors, and marketing platforms. When these vendors are located outside the EEA, companies must ensure that they have appropriate transfer mechanisms in place, such as SCCs or BCRs. Vendor contracts must be carefully reviewed and updated to reflect GDPR requirements.
Continuous Monitoring: Data protection is not a one-time exercise; companies must continuously monitor their cross-border data transfers and assess the adequacy of their safeguards. Changes in the legal environment in the recipient country, such as new government surveillance laws, may necessitate a re-evaluation of transfer mechanisms and supplementary measures.
Risk of Enforcement: Data protection authorities in the EU have the power to investigate and enforce GDPR compliance, including cross-border data transfers. Companies found to be in violation of GDPR can face significant fines and reputational damage. The Schrems II ruling has made cross-border data transfers an area of particular scrutiny, increasing the likelihood of enforcement actions.

Steps Global Companies Can Take to Ensure Compliance

Given the complexities and challenges of cross-border data transfers under GDPR, global companies should take a proactive and comprehensive approach to compliance. Some key steps include:

Conduct a Data Audit: Begin by conducting a thorough audit of your organisation’s data processing activities. Identify all cross-border data transfers, the transfer mechanisms in place, and any third-party vendors involved in processing personal data.
Assess Transfer Mechanisms: For each cross-border data transfer, assess the adequacy of the transfer mechanism being used. If you are relying on SCCs, conduct a case-by-case analysis of the legal environment in the recipient country to determine whether supplementary measures are required.
Implement Supplementary Measures: If necessary, implement supplementary measures to ensure that personal data is adequately protected during cross-border transfers. These may include encryption, pseudonymisation, or additional contractual clauses with the data importer.
Review Vendor Contracts: Review your contracts with third-party vendors to ensure that they include appropriate GDPR-compliant data transfer provisions. Consider using SCCs or BCRs where applicable, and ensure that your vendors are also implementing supplementary measures if required.
Conduct Regular DPIAs: Regularly conduct DPIAs for cross-border data transfers, particularly when transferring data to countries without adequacy decisions. This will help you identify and mitigate any risks associated with the transfer.
Monitor Legal Developments: Stay up-to-date on legal developments in countries outside the EEA, particularly those that may impact the adequacy of data protection. Changes in government surveillance laws or data protection regulations may require you to re-evaluate your cross-border transfer mechanisms.
Train Employees: Ensure that your employees, particularly those involved in data processing and compliance, are trained on GDPR requirements and the specific challenges of cross-border data transfers. This will help to foster a culture of compliance within your organisation.

Conclusion

Cross-border data transfers are an essential part of modern business operations, particularly for global companies with operations in multiple countries. However, under the GDPR, these transfers come with significant regulatory obligations and compliance challenges. The Schrems II ruling has further complicated the landscape by invalidating the EU-US Privacy Shield and imposing stricter requirements for the use of SCCs.

Global companies must take a proactive approach to managing cross-border data transfers, including conducting data audits, assessing transfer mechanisms, and implementing supplementary measures where necessary. By doing so, companies can ensure that they are compliant with GDPR, mitigate the risks of enforcement, and protect the privacy rights of individuals in the EU.