The transfer of personal data to non-adequate countries outside Europe has been a hot topic in recent months. This is because the rules on transfers have been tightened following a ruling by the European Court of Justice (Shrems II ruling). In a previous article, you were able to read which additional steps (1 to 6) your organisation must take to achieve an 'equivalent level of protection'. In this article, we elaborate on step 4 from our previous article. We briefly summarise which (technical) measures are recommended by the European Data Protection Board (EDPB).
For the transfer of personal data outside Europe (officially the European Economic Area, EEA), the most common solution is to use SCCs, Standard Contractual Clauses. You conclude this agreement with your data processor outside Europe (the data importer) and can be compared to processor agreements. By including additional (technical) measures in these SCCs, you can fill the gaps in the laws and regulations of a third country. Applying additional measures ensures an equivalent level of protection.
The additional measures you need to take as an organisation can be contractual, organisational or technical. To determine which measures are most effective, it is recommended to consider the factors below:
Taking contractual and organisational measures is often not enough to exclude public authorities' access to the data. Additional technical measures are therefore important. The EDPB lists a number of examples of technical measures your organisation can take. The measures mainly focus on preventing access to the personal data by third-country government bodies. In particular, (transport) encryption, pseudonymisation and splitting personal data into parts (data splitting) are important.
Encryption (scrambling) involves encrypting personal data using an encryption algorithm. Data is transformed from a readable format to an encrypted format, which can only be read after decryption.
Through pseudonymisation, personal data are transformed into a dataset that is no longer directly traceable to a person, as directly identifiable elements of the personal data are removed, such as the name. This dataset can additionally be encoded into a number (extra secure).
Data splitting involves the use of two different processors. The personal data is split into parts so that no part of the data is sufficient for the processors to recover the personal data.
The main requirement for (transport) encryption is that, before sending personal data to third countries, it must be encrypted using strong encryption algorithms. The encryption algorithm should be up-to-date (e.g. by certification) and resilient to encryption analysis performed by public authorities in receiving third countries. In addition, decryption of personal data should only be possible outside the third country. As a final condition, the encryption must be reliably managed and kept only under the control of your organisation or designated third parties within the EEA.
If pseudonymisation is used, personal data are no longer traceable to an individual without the use of additional information (the 'pseudonymisation key'). This key must remain within your organisation, at least not be passed on to the third-country organisation. Your organisation must additionally take appropriate technical and organisational safeguards that allow you to retain sole control over the algorithm and storage location of the pseudonymisation key that enables decryption.
If data splitting is used, the main condition is that the two or more split parts of personal data can both no longer lead to a specific person without the use of additional information.
In its opinion, the EDPB also addresses situations where measures taken do not provide sufficient protection for the transfer of personal data to third countries.
An example is when using a service provider in the third country (the data importer) that needs access to the 'bare' (not encrypted or pseudonymised) personal data to perform its service.
If there is a high risk of such unencrypted personal data being accessed by public authorities in the third country, it cannot be prevented that individuals' rights are infringed in the process. The EDPB indicates that technological developments in the future may well provide sufficient protection for 'bare' personal data.
The EDPB's recommendations make it clear once again that organisations in the EEA, which export personal data to (non-adequate) third countries, remain independently responsible for ensuring secure processing in these third countries.
The additional measures to be taken depend on the personal data an organisation transfers and the extent to which a third country's level of protection falls short. It may also be that in your case no single measure is suitable to ensure the protection of personal data. In that case, no transfer can take place.
The measures you need to take to safeguard the privacy of your customers are complex and increasingly extensive. We can imagine that this is not a daily and easy task for you. We would be happy to help you with that!