Keep up to date with our latest insight pieces, news and industry developments. See below for the latest posts or use the categories to hone your search for stories of interest.
Rather listen? The WABChats Podcast provides engaging and informative conversations with contacts, clients, advisors and friends of White & Black Limited. Listen Now.
EU Commission publishes amendments to law to ensure lawfulness of international data transfers after Schrems
Last month, the European Commission (Commission) published two Commission Implementing Decisions (Decisions) which amend two existing adequacy decisions that were held to be illegal following the European Court of Justice’s ruling in the Schrems case on standard contractual clauses (SCCs) and transfers to so-called ‘white listed’ countries (countries outside the European Economic Area (EEA) where the Commission has made a positive finding of adequacy, (Recognised Countries)).
The amendments give national data protection authorities the power to suspend or restrict transfers to countries outside of the EEA where such an authority deems that adequate protection of EU citizen’s personal data is no longer guaranteed in that country. Where a national data protection authority takes action to prevent data transfers to a country for this reason, the authority must notify the Commission without delay.
A new Article 3a in the amended Decision (EU) 2016/2295 on Recognised Countries states that the Commission will monitor developments in the law in respect of each Recognised Country to ensure that it continues to provide an adequate level of protection of personal data. Member States and the Commission are also under a new obligation to inform each other of cases where an adequate standard of protection has not been met in a Recognised Country.
The current Recognised Countries are; Andorra, Argentina, Canada, Uruguay, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand and Switzerland. The United States is also considered to provide adequate protection under the EU-US Privacy Shield.
The introduction of extra safeguards aims to provide reassurance that national data protection authorities can exercise all the powers given to them under EU and national law. However, it is yet to be seen what effect, if any, the amended Decisions will have on the ongoing Schrems case in the Irish courts.
Disclaimer: This article is produced for and on behalf of White & Black Limited, which is a limited liability company registered in England and Wales with registered number 06436665. It is authorised and regulated by the Solicitors Regulation Authority. The contents of this article should be viewed as opinion and general guidance, and should not be treated as legal advice.