Did you know that data transfers from and to the European Union (EU) are subject to GDPR compliance? Well, all businesses collecting and processing EU user data outside of the EU must comply with the provisions of the GDPR pertaining to international data transfers. The GDPR contains principles governing data security for transfers of data outside of the EU. The GDPR requires that any international data transfer may be undertaken only if the third countries (those outside of the EU) implement efficient data protection mechanisms.
Who has to comply
The burden of compliance is on the data controller(s) and the data processor(s) to ensure that the third countries to which personal data is being transferred comply with the GDPR so that the user data protection guaranteed by the GDPR is not undermined.Â
What types of organisations are most affected?
These GDPR provisions are intended to apply to the data protection of EU user data, no matter where it is collected, stored, transferred or processed. The GDPR affects all businesses engaged in cross border data transfers, online IT, cloud computing, remote access or global database services.
Are there appropriate safeguards for data transfers?
International data transfer is permissible by having appropriate safeguards in place. Causes of action can be brought by relevant parties whose data was used during said data transfer.
Businesses should establish the following as part of their GDPR compliance program:
-
A list of approved countries for data transfer;
-
Availability of a legally binding agreement between public authorities;
-
Binding corporate rules (agreements governing transfers made between various organizations within a corporate group);
-
Inclusion of standard data protection clauses in relevant contracts;
-
Compliance with an approved code of conduct; and
-
Availability of a GDPR certification.
Â
It should be noted that businesses must protect user data even when the above safeguards are in place.
Can businesses undertake their own assessment of the adequacy of protection?
No. The GDPR requires businesses to closely monitor and adhere to the specific guidelines established in the regulation.
EU-US Privacy Shield
The EU-US Privacy Shield provides a framework for protection of personal EU user data that is transferred to the US for commercial purposes. The Privacy Shield is in line with the principles outlined in the GDPR.
This arrangement contains provisions pertaining to:
-
Strong data-protection obligations on businesses receiving data;
-
Safeguards on US government access to data; and
-
A mechanism for an effective protection and redressal for individuals.
Businesses in the United States have the option to self-certify and join the Privacy Shield by completing the required documentation. Once enrolled, these businesses must follow defined data protection safeguard measures. In addition, they are required to submit annual compliance reports to confirm continued adherence.
As a result, organizations that commit to Privacy Shield compliance are permitted to transfer personal data to and from the European Union. Consequently, these transfers may take place without the need for additional approvals or restrictions, provided all program requirements remain satisfied.
Are there any exceptions available for international data transfers?
Yes. Cross border transfers are permissible only in the following exceptional situations:
-
Explicit consent from end user: If end user provides an explicit consent after being informed of all possible risks involved in data transfers;
-
Performance obligations: Data transfer is necessary at end user’s request or performance obligation pursuant to contract with end user;
-
Public interest: Public interest causes may preclude data transfer restrictions; and
-
Legal claims: Enforcement of legal claims may also preclude data transfer rules under the GDPR.
Businesses cannot under international data transfers even after obtaining user consent if the transfers are taking place on a large scale.
Conclusion
The GDPR has introduced several compliance requirements for international data transfers. As a result, many companies must adjust how they collect, store, and share personal data. These changes directly affect how organizations conduct cross-border business.
At the same time, the EU-US Privacy Shield offers an opportunity for US businesses to participate and demonstrate their commitment to protecting user data. By taking part, organizations signal that privacy protection is a priority.
Therefore, companies must actively manage their data transfer programs and remain alert to regulatory developments. When handled correctly, international data transfer compliance can strengthen customer trust and show a clear commitment to addressing privacy concerns.
If your organization has any governance, risk mitigation, ethical or regulatory compliance concerns, we can help simplify things for you. Contact us directly at 908-447-0521 or via email at info@riddlecompliance.com.
