Germany: BfDI issues information letter on Schrems II case impact
The Federal Commissioner for Data Protection and Freedom of Information ('BfDI') issued, on 8 October 2020, an information letter on the impact of the Court Justice of the European Union's ('CJEU') judgment in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('the Schrems II Case'). In particular, the letter recalls that the judgment confirmed that personal data transferred to a third country must enjoy equivalent protection as under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). In addition, the letter outlines that the judgment denied, in relation to the US, an essentially equivalent level of protection. Therefore, the letter highlights that transfers of data to the US cannot be made under the invalidated EU-US Privacy Shield, but also that other transfers mechanisms, including Standard Contractual Clauses ('SCCs') and Binding Corporate Rules ('BCRs'), are going to be affected.
Furthermore, and in relation to the transfers of data to third countrys, the letter highlights that exporters transferring data on the basis of SCCs and BCRs must assess whether the third country ensures an essentially equivalent protection, eventually introducing additional measures when the law of the third country does not present an adequate level of protection. Moreover, and in relation to data transfers to the US, the letter notes that such transfers remain in principle possible under SCCs and BCRs, but that additional measures must be adopted on a case-by-case basis, testing and documenting the same comprehensively. In the case controllers planning to export data find that an equivalent level of protection cannot be ensured, and the transfer is still not suspended, the letter provides that they must report the same to the BfDI itself.