Skip to Content

Guidance Released From German Data Protection Authority: Time to Review EU Data Transfer Mechanisms
August 28, 2020
In the wake of Schrems II, the July 16, 2020, decision from the European Court of Justice that invalidated the EU-U.S. Privacy Shield as a legal means of data transfer between the European Union and the United States, businesses have been waiting for more concrete guidance from EU data protection authorities on what the state of play is with data transfers out of the European Union. With the abandonment of the Privacy Shield, it is already becoming clear that EU data protection authorities intend to actively enforce immediately.

This week, guidance finally emerged from one data protection authority in Germany. The data protection authority of Baden-Württemberg issued its own guidance on how companies should approach their data transfer analysis in a post-Schrems II world.

The following are a few key points from that guidance that businesses should consider as they revisit their data transfers:

  • Now Is the Time to Revisit Your Transfers - Don't Wait for Some New Program: Schrems II invalidated the Privacy Shield as a legal mechanism for data transfer. Continued reliance on the Privacy Shield is a "no go": it was clearly signaled by this German data protection authority that it will not hesitate to enforce and fine companies that continue to solely rely on the Privacy Shield.
  • Standard Contractual Clauses Are Not Sufficient on Their Own: If your business has been using standard contractual clauses in addition to the Privacy Shield, the German data protection authority made it clear that standard contractual clauses on their own do not provide a sufficient basis for legal data transfer. Using supports, such as encryption, is paramount to ensuring that individual data is protected during transfer.
  • Check on Your Service Providers and Data Transfers. Are your service providers aware of the Schrems II decision? What is their legal basis for data transfer? Revisiting every data transfer with your service providers and ensuring they are still legally justifiable should be high on your priority list.
  • Revisit Your Contracts. Businesses may want to revisit their standard contractual clauses and add supplemental clauses and changes.

While there may be a temptation to "wait and see" what happens in the wake of the invalidation of the Privacy Shield, as many businesses did after Schrems I invalidated the old Safe Harbor program in 2015, the guidance from the German data protection authority is likely the first in a wave of opinions and guidance to be issued by the EU data protection authorities. It's no longer 2015: the GDPR is in full effect, and the data protection authorities have been active in their monitoring of U.S. companies.
Related Practices
Cybersecurity and Privacy
©2024 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.

Disclaimer

The information on this website is presented as a service for our clients and Internet users and is not intended to be legal advice, nor should you consider it as such. Although we welcome your inquiries, please keep in mind that merely contacting us will not establish an attorney-client relationship between us. Consequently, you should not convey any confidential information to us until a formal attorney-client relationship has been established. Please remember that electronic correspondence on the internet is not secure and that you should not include sensitive or confidential information in messages. With that in mind, we look forward to hearing from you.