Freedom from the tyranny of supplementary measures

Handley Gill Limited’s specialist data protection consultants consider the impact of the European Commission’s adequacy decision in respect of the Trans-Atlantic EU-US Data Privacy Framework and the steps controllers and processors should take in relation to transfers of personal data from the EEA and UK to the USA.

Nicola Cain11 July 2023Data Protection, Personal Data, GDPR, General Data Protection Regulation, Regulation (EU) 2016/679, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, Data Transfer, Personal Data Transfer, International Transfers, International data transfers, Safe Harbor, Privacy Shield, EU-US Data Privacy Framework, Transatlantic Data Privacy Framework, Trans-Atlantic Data Privacy Framework, Chapter 5 GDPR, Chapter 5 UK GDPR, Article 44 GDPR, Article 44 UK GDPR, Article 45 GDPR, Article 45 UK GDPR, Article 45(2) GDPR, Article 45(2) UK GDPR, Adequacy Decision, Schrems II, Adequacy Regulations, Section 17A Data Protection Act 2018, S.17A Data Protection Act 2018, S.17A DPA 2018, DPA 2018, Data Protection Act 2018, Standard contractual clauses, Standard data protection clauses, Supplementary Measures, Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, Transfer Risk Assessment, Transfer Impact Assessment, International Data Transfer Agreement, International Data Transfer Addendum, IDTA, SCCs, Modernised SCCs, Modernised Standard Contractual Clauses, Executive Order 14086, Qualifying State, TADPF, US Data Transfers, UK-US Data Bridge, Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, FISA 702, Prism, Upstream, EU-US DPF, Data Controller, Data Processor, Data exporter, Data ImporterComment

A bridge to nowhere?

A commitment to establishing a UK-US data bridge, which would take the form of adequacy regulations being issued by the Secretary of State pursuant to section 17A Data Protection Act 2018, has been announced. Since this bridge is likely to be contingent on the European Commission issuing its own adequacy decision, and the draft has recently been rejected by the European Parliament, data exporters will be reliant on the Commission ramming through the roadblock or will find themselves stuck in traffic on the UK-US data flyover.

Nicola Cain18 June 2023Data Protection, Personal Data, GDPR, General Data Protection Regulation, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, Privacy Shield, Schrems II, Transatlantic Data Privacy Framework, Adequacy Decision, EUROPEAN COMMISSION, Safe Harbor, Adequacy Regulations, UK Adequacy, Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities, EU-US Data Privacy Framework, UK-US Data Bridge, Chapter 5 GDPR, Chapter 5 UK GDPR, Article 45 GDPR, Article 45 UK GDPR, Article 46 GDPR, Article 46 UK GDPR, Data Protection Act 2018, Section 17A Data Protection Act 2018, s17A Data Protection Act 2018, Qualifying State, Executive Order 14086, TADPF, European Parliament, Committee on Civil Liberties, Committee on Civil Liberties Justice & Home Affairs, LIBE Committee, European Data Protection Board, EDPB, Opinion 5/2023, German-American Data Protection Day, DoJ, Department of Justice, Standard contractual clauses, Standard data protection clauses, Supplementary Measures, Transfer Risk Assessment, Transfer Impact Assessment, Derogation, Data Transfer, Data transfer agreement, US Data Transfers, International Transfers, International data transfers, International Data Transfer Risk Assessment, Data Controller, Data Processor, Data exporter, Data ImporterComment

Biden waves Privacy Magic Wand

President Biden issued Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities on 07 October 2022, enhancing the safeguards afforded to global citizens and laying the foundation for adequacy findings by the European Commission and Secretary of State for ex-EEA and ex-UK restricted international data transfers. While the risk of legal challenge to any adequacy finding would remain, such findings would provide welcome respite for the millions of data exporters who are neither equipped nor resourced to conduct wide ranging reviews of foreign legislation at an individual level.

Nicola Cain8 October 2022Data Protection, Personal Data, GDPR, General Data Protection Regulation, Regulation (EU) 2016/679, Article 45 GDPR, Article 45(2) GDPR, Article 46 GDPR, UK GDPR, Article 45(2) UK GDPR, Data Protection Act 2018, DPA 2018, Section 74A Data Protection Act 2018, S.74A Data Protection Act 2018, International Data Transfers, Restricted International Data Transfers, Adequacy Decision, Adequate Countries, Qualifying State, international Data Transfer Risk Assessment, Safe Harbor, Privacy Shield, Transatlantic Data Privacy Framework, Trans-Atlantic Data Privacy Framework, Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities, Max Schrems, noyb, Schrems II, Case C 311/18, CJEU, Secretary of State for Digital Culture Media & Sport, Michelle Donelan MP, European Commission, President Ursula von der Leyen, President Joe Biden, US Secretary of Commerce, Gina Raimondo, European Data Protection Board, Civil Liberties Protection Officer of the Office of the Director of National Intelligence, Civil Liberties Protection Officer, Privacy and Civil Liberties Oversight Board, Privacy and Civil Liberties Officer, Presidential Policy Directive 28 of January 17, 2014 (Signals Intelligence Activities) (PPD-28), Inspector General, Data Protection Review Court, Executive Order 14086, Executive Order on Enhancing Safeguards for United States Signals Intelligence ActivitiesComment