#25 CJEU Invalidates EU-US Privacy Shield, but Considers the Standard Contractual Clauses Valid?

On 16 July 2020 the Court of Justice of the European Union (CJEU) issued a preliminary ruling with significant importance regarding the instruments for transfer of personal data outside EU to so called “third countries”, in particular to the US.

Why it has come this far?

The request for a preliminary ruling was made in connection with the actions of Austrian privacy activist Mr. Maximillian Schrems who turned to the Irish Data Protection Commissioner asking for the suspension of the transfers of his data as Facebook’s user made by Facebook to the US, at this stage mainly based on the Standard Contractual Clauses (SCC). After the invalidation of Safe Harbour framework that was previously in place for EU-US data transfers (the Schrems I case), Mr. Schrems argued that the SCC do not provide a sufficient level of personal data protection in transfers from the EU to the US, since the rules in the US create conditions for disregard for the contractual obligations of legal persons (in this case  of Facebook) in connection with the SCC concluded by them. In the meantime, a new framework – the EU-US Privacy Shield – was adopted and its validity was also put into question with the reference to the CJEU.

What are the key takeaways from the CJEU’s judgement?

  • The EU-US Privacy Shield framework is invalid. The main arguments of CJEU are that:

(1) the US local laws enabling access and use of public authorities (via different surveillance programs) to personal data for national security, public interest and law enforcement purposes set limitations on personal data protection that are not proportionate and limited to what is strictly necessary as required by the EU law;

(2) the Ombudsperson mechanism in the Privacy-Shield framework does not provide data subjects with any cause of action before a body which offers guarantees substantially equivalent to those required by EU law, because the Ombudsperson:

(a) cannot be considered independent, as is appointed by the US Secretary of State and is an integral part of the US State Department, and

(b) is not empowered to adopt binding decisions on the US intelligence services.

  • Where personal data are transferred pursuant to SCC, a level of protection essentially equivalent to that guaranteed within the EU by the GDPR and the Charter of Fundamental Rights of the EU must be afforded. According to CJEU, this means a case by case assessment regarding both the contractual clauses agreed between the EU-data exporter and the third country- recipient, and any access by the public authorities of that third country to the data transferred, as well as the relevant aspects of the legal system of that third country.
  • Decision 2010/87 establishing the Standard Contractual Clauses as a tool for transfer of personal data remains valid.

According to CJEU, the Decision establishing the SCC contains effective mechanisms that make it practically possible to ensure compliance with the EU required level of protection and to suspend or prohibit the transfer in the event of the breach of the SCC or in case it becomes impossible to honour them. These mechanisms are:

(1) the obligation of the data exporter and the data recipient to verify, prior to any transfer, whether that level of protection is respected in the third country, and

(2) the requirement for the recipient to inform the data exporter of any inability to comply with the SCC, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the former.

  • Member States’ supervisory authorities are required to suspend or prohibit a transfer of personal data to a third country where:

(1) in the light of all the circumstances of the case, they consider:

(a) the SCC are not or cannot be complied with in that third country, and

(b) the protection of the data transferred that is required by EU law cannot be ensured by other means, and

(2) the EU-data exporter has not itself suspended or put an end to this transfer.

Why this decision is important?

The CJEU’s decision is crucial, because it reaffirms the problems regarding the EU-US data transfers identified years ago with the invalidation of Safe Harbour mechanism. It means that the EU will maintain its policy to insist on ensuring the highest possible data protection standards in its relations with third countries. The CJEU’s decision is a strong message to US government calling for implementation of additional safeguards in terms of data protection-national security paradigm.

For the business it means future uncertainties on how to lawfully arrange data transfers to third countries, especially to US, because:

  • one of the key tools for data transfers to US – the Privacy Shield – is no longer available;
  • the considerations of CJEU regarding non-conformity of the US surveillance programs with the EU privacy standards put in question whether the SCC – probably the most popular tool for data transfers – can be properly used for transfers to the US.

A probable solution could be a new privacy deal struck between EU and US, but in order to avoid the faith of Safe Harbour and the Privacy Shield, it needs to carefully address the issues identified by the CJEU that led to the invalidation of these tools.

Lastly, it seems likely to expect proactive approach from Member State supervisory authorities in terms of data transfers, especially in the light of their newly reaffirmed powers to suspend or prohibit a transfer based on SCCin certain cases where the effective compliance with the SCC in the third country or the level of data protection required by EU cannot be fully achieved.

Useful links:

  • The full decision of the CJEU can be found here
  • Press release of the CJEU can be found here
  • Statement of the Irish supervisory authority on the CJEU decision can be found here
  • Statement of the European Data Protection Board on the CJEU decision can be found here.

#24 Personal Data Protection in the Context of Assignment of Receivables (Cession) Agreement

Pursuant to the assignment of receivables (cession) agreement the creditor under a certain receivable (assignor) assigns it to a third party (assignee). As the assignment procedure involves processing of personal data of a third party – a debtor that is not a party to the agreement, thorough examination of the personal data protection rules and their applicability to the assignment of receivables is required. The present analysis examines a situation where the debtor is a natural person. The conclusions outlined below can be applied by analogy to assignments where the debtors are legal entities, taking into account the specifics of the relationship between legal entities (i.e. exchange of information about their legal representatives, proxies, etc.).

Is the debtor’s consent required for the purposes of assigning their receivables?

The consent under an assignment agreement may be approached from two perspectives:

  • Consent for the transaction itself – the debtor is not a party to the assignment agreement and their consent is not required for the transaction to take effect.
  • Consent as a basis for processing the debtors personal data – consent might also be viewed as a one of the legal grounds for processing personal data under Regulation 2016/679 (GDPR). As the debtor needs be able to assess whether, for what purposes and for what period of time to give their consent, it is an inappropriate legal grounds for personal data processing under assignment agreements. This is explained by the fact that if processing is based on consent, it would allow the debtor to block the creditor from disposing of their receivables by preventing the creditor from processing the personal data contained in the debt documentation or debt related documents – information about who the debtor is and what his contact details are, where his obligation arises from, what is its amount and maturity, etc.

What is the basis for the personal data processing under the assignment agreement?

Other legal grounds, equal and alternative to the consent, may serve as basis for processing the debtor’s personal data, namely:

  • Regarding the assignor:
    • Compliance with a legal obligation – to provide the assignee with the debt documentation, i.e. to carry out the related processing of the personal data contained therein;
    • Existence of legitimate interest– to dispose of its receivable as it deems appropriate.
  • Regarding the assignee, besides the legitimate interest to collect their receivable, there is additional legal grounds for the personal data processing – the performance of a contract to which the data subject is a party (this is the contract under which the receivable has arisen). This ground, however, may be relevant, provided that the assignment has lead an action against the debtor by notification under Art. 99, Para. 3 and 4 of the Contracts and Obligations Act.

According to the Commission for Personal Data Protection (CPDP), the legal fact which makes the personal data processing admissible is the assignment of the receivable, not the notification of the debtor. This means that the assignee may lawfully process the debtor’s personal data even prior to this notification.

Other requirements for the personal data protection in the case of assignment of receivables

An essential requirement to be fulfilled in case of an assignment is the notification of the debtor of the processing of their personal data, since the data controller – assignee obtains the personal data not directly from the data subject, but from another source – the assignor. In order to ensure transparent data processing, the data subject needs to be provided with information under Art. 14 of the GDPR, namely:

  1. the identity and the contact details of the controller;
  2. the contact details of the data protection officer, where applicable;
  3. the purposes and legal basis for the processing;
  4. the categories of personal data concerned;
  5. the recipients of the personal data;
  6. the period for which the personal data will be stored;
  7. where applicable, the controller’s intention to transfer the personal data to a third country or international organisation, as well as additional information related to such data transfer;
  8. the legitimate interests pursued by the controller or by a third party when the processing is carried out on this ground;
  9. information on the rights of the data subject with respect to the processing;
  10. the source of the personal data;
  11. additional information in case the data is used for automated decision-making, including profiling.

The GDPR requires the controller to provide this information as follows:

  • within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;
  • if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject;
  • if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

In practice, there are numerous cases where assignees have been sanctioned specifically for non-compliance with the above requirement to inform the data subject. The GDPR, as a rule, allows exceptions to the above obligation to provide information if the receipt or disclosure of data is expressly permitted by EU law or the laws of a Member State, which provides for appropriate measures to protect the legitimate interests of the data subject. It is unclear how CPDP will interpret this rule in the context of the assignment agreement (under which the disclosure and receipt of data is explicitly regulated by the Bulgarian legislation). Given the above practice of imposing sanctions, a safer approach for assignees would be to expressly notify the data subjects.

It is permitted to inform the data subject of the processing in parallel with notifying the debtor of the assignment by the assignee. This is explicitly recognized in the case law.

Is it possible that the expired limitation period of the assigned receivable affects the lawfulness of the personal data processing?

Whether the prescribed limitation period for the receivable has expired or not, whether the debtor’s objection to the expired limitation period has been duly exercised, etc., are all issues within the jurisdiction of the civil court and do not affect the lawfulness of the personal data processing.

You may read an article on the topic by Martin Zahariev here: https://www.tita.bg/free/commercial-law/660