Baden-Württemberg: LfDI Baden-Württemberg issues Schrems II checklist and recommends amendments to SCCs
The Baden-Württemberg data protection authority ('LfDI Baden-Württemberg') issued, on 24 August 2020, its orientation guide ('the Guide') on international data transfers in light of the Court of Justice of the European Union ('CJEU') ruling of 16 July 2020 in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('the Schrems II Case').
In particular, the LfDI Baden-Württemberg noted that the Schrems II Case declared Standard Contractual Clauses ('SCCs') valid but that there must be a level of personal data protection which corresponds to that within the EU. In addition, the LfDI Baden-Württemberg noted that this is to be interpreted in the light of the EU Charter of Fundamental Rights and Article 46(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), with suitable guarantees from the controller and processor, enforceable rights and effective remedies for the data subjects.
Checklist for compliant data transfers
The Guide includes a checklist that will further support companies in taking steps to comply with the Schrems II Case, including:
- taking stock of the cases in which they or their data protection authority exports personal data to third countries;
- contacting their contractual partners or service providers to inform them of the consequences of the Schrems II Case;
- checking whether there is an adequacy decision for the third country;
- researching the legal environment in the third country;
- checking if the SCCs which were approved by the European Commission can be used; and
- verifying that SCCs are in use and that there are additional transfer guarantees to the third country
Changes to SCCs
The Guide outlines that to demonstrate and document willingness to comply with the GDPR, controllers should contact the recipient of the data in regard to the following amendments to SCCs:
- Amendment to Annex Clause 4(f): informing affected persons not only when transmitting special categories of data, but with any data transmission (before or as soon as possible after the transmission) that their data will be transferred to a third country which does not have an adequate level of protection in the sense of the GDPR;
- Amendment of Annex Clause 5(d)(i): the duty of the data importer to inform not only the data exporter, but also the data subject(s) immediately about all legally binding requests from an enforcement authority to pass on the personal data; if this information transfer is otherwise prohibited, for example by a criminal law prohibition to maintain investigation secrecy in acriminal investigation, you must contact the supervisory authority and clarify the procedure;
- Supplement to Annex Clause 5(d): to include obligations for the data importer to refrain against the disclosure of personal data to the respective authorities until the competent court sentences them to disclose such data; and
- Amendment to Annex Clause 7(1): to only include Clause 7(1)(b) to referring the dispute to the courts of the Member State in which the data exporter is established in the event that a data subject asserts rights as a third party beneficiary and / or claims for damages against the data importer based on the contractual clauses.
In addition, the LfDI Baden-Württemberg included an example of a compensation clause mentioned in Annex 2.
The LfDI Baden-Württemberg highlighted that while it is obliged to take action according to the Schrems II Case, it will do so according to the principle of proportionality and always ask whether or not there is no alternative to transferring data to the US. The LfDI Baden-Württemberg also detailed that the focus will be on whether there are reasonable alternative offers that do not cause data transfer issues in addition to the service provider chosen by the respective German company. Concretely, the LfDI Baden-Württemberg stated that if a company cannot convince its office that the service provider with data transfer issues is irreplaceable in the short and medium term, then the data transfer will be prohibited by the LfDI Baden-Württemberg.
UPDATE (8 September 2020)
LfDI Baden-Württemberg issues updated version of the Guide
The LfDI Baden-Württemberg announced, on 7 September 2020, that it had issued an updated version of the Guide ('the Updated Guide'), including details on informing data subjects of data transfers, records of processing, and the responsibility and compensation clauses of the involved parties.