Comité européen de la protection des données (EDPB)

Foire aux questions sur l’arrêt rendu dans l’affaire C-311/18 - Data Protection Commissioner contre Facebook Ireland Ltd et Maximillian Schrems (23 juillet 2020)

L'objectif de ce document consiste à fournir des réponses à plusieurs questions fréquemment posées aux autorités de contrôle; ces questions seront développées et complétées par des analyses plus approfondies, étant donné que le comité européen de la protection des données continue d'examiner et d'évaluer l'arrêt rendu par la Cour de justice de l'Union européenne (la «Cour»).

Lien

Recommandations sur les mesures qui complètent les instruments de transfert destinés à garantir le respect du niveau de protection des données à caractère personnel de l’UE - 1/2020 (18 juin 2021) (anglais)

The EU General Data Protection Regulation (GDPR) was adopted to serve a dual-purpose: facilitating the free flow of personal data within the European Union, while preserving the fundamental rights and freedoms of individuals, in particular their right to the protection of personal data.

In its recent judgment C-311/18 (Schrems II) the Court of Justice of the European Union (CJEU) reminds us that the protection granted to personal data in the European Economic Area (EEA) must travel with the data wherever it goes. Transferring personal data to third countries cannot be a means to undermine or water down the protection it is afforded in the EEA. The Court also asserts this by clarifying that the level of protection in third countries does not need to be identical to that guaranteed within the EEA but essentially equivalent. The Court also upholds the validity of standard contractual clauses, as a transfer tool that may serve to ensure contractually an essentially equivalent level of protection for data transferred to third countries.

Standard contractual clauses and other transfer tools mentioned under Article 46 GDPR do not operate in a vacuum. The Court states that controllers or processors, acting as exporters, are responsible for verifying, on a case-by-case basis and, where appropriate, in collaboration with the importer in the third country, if the law or practice of the third country impinges on the effectiveness of the appropriate safeguards contained in the Article 46 GDPR transfer tools. In those cases, the Court still leaves open the possibility for exporters to implement supplementary measures that fill these gaps in the protection and bring it up to the level required by EU law. The Court does not specify which measures these could be. However, the Court underlines that exporters will need to identify them on a case-by-case basis. This is in line with the principle of accountability of Article 5.2 GDPR, which requires controllers to be responsible for, and be able to demonstrate compliance with the GDPR principles relating to processing of personal data.

To help exporters (be they controllers or processors, private entities or public bodies, processing personal data within the scope of application of the GDPR) with the complex task of assessing third countries and identifying appropriate supplementary measures where needed, the European Data Protection Board (EDPB) has adopted these recommendations. These recommendations provide exporters with a series of steps to follow, potential sources of information, and some examples of supplementary measures that could be put in place.

As a first step, the EDPB advises you, exporters, to know your transfers. Mapping all transfers of personal data to third countries can be a difficult exercise. Being aware of where the personal data goes is however necessary to ensure that it is afforded an essentially equivalent level of protection wherever it is processed. You must also verify that the data you transfer is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

A second step is to verify the transfer tool your transfer relies on, amongst those listed under Chapter V GDPR. If the European Commission has already declared the country, region or sector to which you are transferring the data as adequate, through one of its adequacy decisions under Article 45 GDPR or under the previous Directive 95/46 as long as the decision is still in force, you will not need to take any further steps, other than monitoring that the adequacy decision remains valid. In the absence of an adequacy decision, you need to rely on one of the transfer tools listed under Articles 46 GDPR. Only in some cases you may be able to rely on one of the derogations provided for in Article 49 GDPR if you meet the conditions. Derogations cannot become “the rule” in practice, but need to be restricted to specific situations.

A third step is to assess if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on, in the context of your specific transfer. Your assessment should be focused first and foremost on third country legislation that is relevant to your transfer and the Article 46 GDPR transfer tool you are relying on. Examining also the practices of the third country’s public authorities will allow you to verify if the safeguards contained in the transfer tool can ensure, in practice, the effective protection of the personal data transferred. Examining these practices will be especially relevant for your assessment where:

(i) legislation in the third country formally meeting EU standards is manifestly not applied/complied with in practice;

(ii) there are practices incompatible with the commitments of the transfer tool where relevant legislation in the third country is lacking;

(iii) your transferred data and/or importer fall or might fall within the scope of problematic legislation (i.e. impinging on the transfer tool’s contractual guarantee of an essentially equivalent level of protection and not meeting EU standards on fundamental rights, necessity and proportionality).

In the first two situations, you will have to suspend the transfer or implement adequate supplementary measures if you wish to proceed with it.

In the third situation, in light of uncertainties surrounding the potential application of problematic legislation to your transfer, you may decide to: suspend the transfer; implement supplementary measures to proceed with it; or alternatively, you may decide to proceed with the transfer without implementing supplementary measures if you consider and are able to demonstrate and document that you have no reason to believe that relevant and problematic legislation will be interpreted and/or applied in practice so as to cover your transferred data and importer. For evaluating the elements to be taken into account when assessing the law of a third country dealing with access to data by public authorities for the purpose of surveillance, please refer to the EDPB European Essential Guarantees recommendations. You should conduct this assessment with due diligence and document it thoroughly. Your competent supervisory and/or judicial authorities may request it and hold you accountable for any decision you take on that basis.

A fourth step is to identify and adopt supplementary measures that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence. This step is only necessary if your assessment reveals that the third country legislation and/or practices impinge on the effectiveness of the Article 46 GDPR transfer tool you are relying on or you intend to rely on in the context of your transfer. These recommendations contain (in Annex 2) a non-exhaustive list of examples of supplementary measures with some of the conditions they would require to be effective. As is the case for the appropriate safeguards contained in the Article 46 transfer tools, some supplementary measures may be effective in some countries, but not necessarily in others. You will be responsible for assessing their effectiveness in the context of the transfer, and in light of the third country law and practices and the transfer tool you are relying on, as you will be held accountable for any decision you take on that basis. This might also require you to combine several supplementary measures. You may ultimately find that no supplementary measure can ensure an essentially equivalent level of protection for your specific transfer. In those cases where no supplementary measure is suitable, you must avoid, suspend or terminate the transfer to avoid compromising the level of protection of the personal data. You should also conduct this assessment of supplementary measures with due diligence and document it.

A fifth step is to take any formal procedural steps the adoption of your supplementary measure may require, depending on the Article 46 GDPR transfer tool you are relying on. These recommendations specify some of these formalities. You may need to consult your competent supervisory authorities on some of them.

The sixth and final step is to re-evaluate at appropriate intervals the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.

Supervisory authorities will continue exercising their mandate to monitor the application of the GDPR and enforce it. Supervisory authorities will pay due consideration to the actions exporters take to ensure that the data they transfer is afforded an essentially equivalent level of protection. As the Court recalls, supervisory authorities will suspend or prohibit data transfers in those cases where they find that an essentially equivalent level of protection cannot be ensured, following an investigation or a complaint. Supervisory authorities will continue developing guidance for exporters and coordinating their actions in the EDPB to ensure consistency in the application of EU data protection law.

Lien

Recommandations sur les garanties essentielles européennes pour les mesures de surveillance - 2/2020 (10 novembre 2020)

1. À la suite de l’arrêt Schrems I, les autorités de l’UE chargées de la protection des données réunies au sein du groupe de travail «Article 29» se sont appuyées sur la jurisprudence pour recenser les garanties essentielles européennes à respecter afin que les ingérences dans les droits fondamentaux au respect de la vie privée et à la protection des données par le biais de mesures de surveillance lors du transfert de données à caractère personnel n’aillent pas au-delà de ce qui est nécessaire et proportionné dans une société démocratique.

2. Le comité européen de la protection des données tient à souligner que les garanties essentielles européennes reposent sur la jurisprudence de la Cour de justice de l’Union européenne (ci-après la «CJUE») concernant les articles 7, 8, 47 et 52 de la Charte des droits fondamentaux de l’Union européenne (ci-après la «Charte») et, le cas échéant, sur la jurisprudence de la Cour européenne des droits de l’homme (ci-après la «CouEDH») relative à l’article 8 de la Convention européenne des droits de l’homme (ci-après la «CEDH») concernant les questions de surveillance dans les États parties à la CEDH 

3. La mise à jour du présent document vise à préciser davantage les garanties essentielles européennes élaborées à l’origine en réponse à l’arrêt Schrems I, en tenant compte des clarifications apportées par la CJUE (et par la CouEDH) depuis sa publication, notamment dans son arrêt phare Schrems II.

4. Dans son arrêt Schrems II, la CJUE a déclaré que l’examen de la décision 2010/87/UE de la Commission relative aux clauses contractuelles types pour le transfert de données à caractère personnel vers des sous-traitants établis dans des pays tiers, à la lumière des articles 7, 8 et 47 de la Charte, n’avait révélé aucun élément de nature à affecter la validité de cette décision, mais elle a invalidé la décision relative au « bouclier de protection des données» (ci-après la «décision BPD»). La CJUE a déclaré que la décision BPD était incompatible avec l’article 45, paragraphe 1, du RGPD, lu à la lumière des articles 7, 8 et 47 de la Charte. L’arrêt peut donc servir d’exemple lorsque des mesures de surveillance prises dans un pays tiers (en l’occurrence, les États-Unis, avec l’article 702 du FISA et le décret présidentiel nº 12 333) ne sont pas suffisamment limitées et ne sont pas susceptibles d’un recours effectif permettant aux personnes concernées de faire valoir leurs droits, comme l’exige le droit de l’Union pour considérer que le niveau de protection dans le pays tiers est «essentiellement équivalent» à celui qui est garanti dans l’Union, au sens de l’article 45, paragraphe 1, du RGPD.

5. Les raisons de l’invalidation du bouclier de protection des données ont également eu des conséquences sur d’autres outils de transfert. Bien que la Cour ait interprété l’article 46, paragraphe 1, du RGPD dans le contexte de la validité des clauses contractuelles types (ci-après les «CCT»), son interprétation s’applique à tout transfert vers des pays tiers au moyen de l’un des outils visés à l’article 46 du RGPD.

6. En dernier ressort, il appartient à la CJUE de juger si des ingérences dans un droit fondamental peuvent être justifiées. Toutefois, en l’absence d’un tel jugement et conformément à la jurisprudence actuelle, les autorités chargées de la protection des données sont tenues d’évaluer les cas individuels, soit d’office, soit à la suite d’une plainte, et de renvoyer l’affaire devant une juridiction nationale si elles soupçonnent que le transfert n’est pas conforme à l’article 45 dans le cas d’une décision d’adéquation, ou de suspendre ou interdire le transfert si elles estiment qu’il n’est pas possible de respecter l’article 46 du RGPD et que la protection des données transférées que requiert le droit de l’Union ne peut pas être assurée par d’autres moyens.

7. Les garanties essentielles européennes mises à jour ont pour but de fournir des éléments permettant de déterminer si des mesures de surveillance autorisant l’accès d’autorités publiques d’un pays tiers à des données à caractère personnel, qu’il s’agisse d’agences de sécurité nationale ou d’autorités répressives, peuvent être considérées comme une ingérence justifiable ou non.

8. En effet, les garanties essentielles européennes font partie de l’évaluation à réaliser afin de déterminer si un pays tiers offre un niveau de protection essentiellement équivalent à celui qui est garanti au sein de l’Union, mais elles n’ont pas en soi pour objectif de définir tous les éléments. nécessaires pour considérer qu’un pays tiers offre ce niveau de protection conformément à l’article 45 du RGPD. De même, elles ne visent pas, en soi, à définir tous les éléments qu’il conviendrait de prendre en considération pour apprécier si le régime juridique d’un pays tiers empêche l’exportateur et l’importateur des données de fournir des garanties appropriées conformément à l’article 46 du RGPD.

9. Par conséquent, les éléments décrits dans le présent document devraient être considérés comme étant les garanties essentielles qui doivent être trouvées dans le pays tiers lors de l’évaluation de l’ingérence, découlant des mesures de surveillance dudit pays, dans les droits au respect de la vie privée et à la protection des données, plutôt que comme une liste d’éléments visant à démontrer que le régime juridique d’un pays tiers dans son ensemble assure un niveau de protection essentiellement équivalent.

10. L’article 6, paragraphe 3, du traité sur l’Union européenne dispose que les droits fondamentaux énoncés dans la CEDH constituent des principes généraux du droit de l’Union. Toutefois, comme le rappelle la CJUE dans sa jurisprudence, la CEDH ne constitue pas, tant que l’Union n’y a pas adhéré, un instrument juridique formellement intégré à l’ordre juridique de l’Union. Dès lors, le niveau de protection des droits fondamentaux exigé par l’article 46, paragraphe 1, du RGPD doit être déterminé sur la base des dispositions dudit règlement, lues à la lumière des droits fondamentaux consacrés par la Charte. Cela étant, conformément à l’article 52, paragraphe 3, de la Charte, les droits contenus dans cette dernière et les droits correspondants garantis par la CEDH doivent avoir la même signification et la même portée que ceux énoncés dans ladite convention et, partant, comme l’a rappelé la CJUE, il convient de tenir compte de la jurisprudence de la CouEDH relative aux droits déjà prévus dans la Charte des droits fondamentaux de l’Union européenne en tant que seuil de protection minimale en vue de l’interprétation des droits correspondants de la Charte . Toutefois, conformément à l’article 52, paragraphe 3, dernière phrase, de la Charte, «[c]ette disposition ne fait pas obstacle à ce que le droit de l’Union accorde une protection plus étendue».

11. Dès lors, la teneur des garanties essentielles continuera de s’appuyer en partie sur la jurisprudence de la CouEDH, dans la mesure où la Charte telle qu’interprétée par la CJUE n’offre pas un niveau de protection supérieur imposant d’autres exigences que la jurisprudence de la CouEDH.

12. Le présent document situe le contexte et précise les quatre garanties essentielles européennes

Lien

Guidelines on articles 46.2.a and 46.3.b of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies - 2/2020 (15 décembre 2020)

This document seeks to provide guidance as to the application of Articles 46 (2) (a) and 46 (3) (b) of the General Data Protection Regulation (GDPR) on transfers of personal data from EEA public authorities or bodies (hereafter “public bodies”) to public bodies in third countries or to international organisations, to the extent that these are not covered by an adequacy finding adopted by the European Commission . Public bodies may choose to use these mechanisms, which the GDPR considers more appropriate to their situation, but are also free to rely on other relevant tools providing for appropriate safeguards in accordance with Article 46 GDPR.

The guidelines are intended to give an indication as to the expectations of the European Data Protection Board (EDPB) on the safeguards required to be put in place by a legally binding and enforceable instrument between public bodies pursuant to Article 46 (2) (a) GDPR or, subject to authorisation from the competent supervisory authority (SA), by provisions to be inserted into administrative arrangements between public bodies pursuant to Article 46 (3) (b) GDPR. The EDPB strongly recommends parties to use the guidelines as a reference at an early stage when envisaging concluding or amending such instruments or arrangements.

The guidelines are to be read in conjunction with other previous work done by the EDPB (including endorsed documents by its predecessor, the Article 29 Working Party (“WP29”)) on the central questions of territorial scope and transfers of personal data to third countries . The guidelines will be reviewed and if necessary updated, based on the practical experience gained from the application of the GDPR.

The present guidelines cover international data transfers between public bodies occurring for various administrative cooperation purposes falling within the scope of the GDPR. As a consequence and in accordance with Article 2 (2) of the GDPR, they do not cover transfers in the area of public security, defence or state security. In addition, they do not deal with data processing and transfers by competent authorities for criminal law enforcement purposes, since this is governed by a separate specific instrument, the law enforcement Directive . Finally, the guidelines only focus on transfers between public bodies and do not cover transfers of personal data from a public body to a private entity or from a private entity to a public body.

Lien (anglais)

The New standard contractual clauses - Questions ans answers

On 4 June 2021, the European Commission adopted two sets of standard contractual clauses, one for the use between controllers and processors within the European Economic Area1 (EEA) and one for the transfer of personal data to countries outside of the EEA. The purpose of these Q&As is to provide practical guidance on the use of the SCCs to assist stakeholders with their compliance efforts. The information in this document does not constitute legal advice. Instead, it is provided for general informational purposes only. The monitoring and enforcement of compliance with EU data protection law by controllers and processors falls within the competence of the national supervisory authorities and courts. The list and contact details of national data protection authorities in the EEA is available here: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

These Q&As are based on feedback received from various stakeholders on their experience with using the new SCCs in the first months after their adoption. This page is intended to be a ‘dynamic’ source of information and its content will be updated as new questions arise.

Link

Guidelines 07/2022 on certification as a tool for transfers (14 Février 2023) (Anglais)

The GDPR requires in its Article 46 that data exporters shall put in place appropriate safeguards for transfers of personal data to third countries or international organisations. To that end, the GDPR diversifies the appropriate safeguards that may be used by data exporters under Article 46 for framing transfers to third countries by introducing, amongst others, certification as a new transfer mechanism (Articles 42 (2) and 46 (2) (f) GDPR).

These guidelines provide guidance as to the application of Article 46 (2) (f) of the GDPR on transfers of personal data to third countries or to international organisations on the basis of certification. The document is structured in four sections with an Annex.

Part one of this document ("GENERAL") clarifies that the guidelines supplement the already existing general Guidelines 1/2018 on certification and addresses specific requirements from Chapter V of the GDPR when certification is used as a transfer tool. According to Article 44 of the GDPR, any transfer of personal data to third countries or international organisations, must meet the conditions of the other provisions of the GDPR in addition to complying with Chapter V of the GDPR. Therefore, as a first step, compliance with the general provisions of the GDPR must be ensured and, as a second step, the provisions of Chapter V of the GDPR must be complied with. The actors who are involved and their core roles in this context are described, with a special focus on the role of the data importer who will be granted a certification and of the data exporter who will use it as a tool to frame its transfers (considering that the responsibility for data processing compliance remains with the data exporter). In this context the certification can also include measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. Part one of the guidelines also contains information on the process for obtaining a certification to be used as tool for transfers.

The second part of these guidelines (“IMPLEMENTING GUIDANCE ON THE ACCREDITATION REQUIREMENTS”) recalls that the requirements for accreditation of a certification body are to be found in ISO 17065 and by interpreting the Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the GDPR and its Annex against the background of Chapter V. However, in the context of a transfer, these guidelines further explain some of the accreditation requirements applicable to the certification body.

The third part of these guidelines ("SPECIFIC CERTIFICATION CRITERIA") provides for guidance on the certification criteria already listed in Guidelines 1/2018 and establishes additional specific criteria that should be included in a certification mechanism to be used as a tool for transfers to third countries. These criteria cover the assessment of the third country legislation, the general obligations of exporters and importers, rules on onward transfers, redress and enforcement, process and actions for situations in which national legislation and practices prevents compliance with commitments taken as part of certification and requests for data access by third country authorities.

Part four of these guidelines (“BINDING AND ENFORCEABLE COMMITMENTS TO BE IMPLEMENTED“) provides elements that should be addressed in the binding and enforceable commitments that controllers or processors not subject to the GDPR should take for the purpose of providing appropriate safeguards to data transferred to third countries. These commitments, which may be set out in different instruments including contracts, shall in particular include a warranty that the importer has no reason to believe that the laws and practices in the third country applicable to the processing at stake, including any requirements to disclose personal data or measures authorising access by public authorities, prevent it from fulfilling its commitments under the certification.

The ANNEX of these guidelines contains some examples of supplementary measures in line with those listed in Annex II Recommendations 01/2020 (Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data) in the context of the use of a certification as a tool for transfers. Examples are constructed with a view to raise attention to critical situations.

Link

Commission européenne

Décision d’exécution (UE) de la Commission relative aux clauses contractuelles types pour le transfert de données à caractère personnel vers des pays tiers en vertu du règlement (UE) 2016/679 du Parlement européen et du Conseil - 2021/914 (4 juin 2021)

Les modèles de clauses contractuelles types sont toujours d’actualité et ont été mis à jour par la Commission européenne le 4 juin 2021.

Lien

Statement on the announcement of an agreement in principle on a new Trans-Atlantic Data Privacy Framework - 1/2022 (6 April 2022)

The EDPB welcomes the announcement of a political agreement in principle between the European Commission and the United States on 25 March on a new Trans-Atlantic Data Privacy Framework. This announcement is made at a time where transfers from the European Economic Area to the U.S. face significant challenges. The commitment of the U.S. highest authorities to establish ‘unprecedented’ measures to protect the privacy and personal data of individuals in the European Economic Area (EEA individuals) when their data are transferred to the U.S. is a positive first step in the right direction. The EDPB will examine how this political agreement translates into concrete legal proposals to address the concerns raised by the Court of Justice of the European Union (CJEU) in order to provide legal certainty to EEA individuals and exporters of data. At this stage, this announcement does not constitute a legal framework on which data exporters can base their data transfers to the United States. Data exporters must therefore continue taking the actions required to comply with the case law of the CJEU, and in particular its Schrems II decision of 16 July 2020. The GDPR requires that the Commission seeks an opinion of the EDPB before adopting a possible new adequacy decision recognising as satisfactory the level of data protection guaranteed by the U.S. authorities. The EDPB looks forward to assessing carefully the improvements that a new Trans-Atlantic Data Privacy Framework may bring in the light of EU law, the case-law of the CJEU and the recommendations the EDPB made on that basis. The EDPB will prepare its opinion when it receives from the European Commission all supporting documents. In particular, the EDPB will analyse in detail how these reforms ensure that the collection of personal data for national security purposes is limited to what is strictly necessary and proportionate. The EDPB will also examine to what extent the announced independent redress mechanism respects the EEA individuals’ right to an effective remedy and to a fair trial. In particular, the EDPB will look at whether any new authority part of this mechanism has access to relevant information, including personal data, when exercising its mission and can adopt decisions binding on the intelligence services. The EDPB will also consider whether there is a judicial remedy against this authority’s decisions or inaction. The EDPB remains committed to playing a constructive part in securing a transatlantic transfer of personal data that benefits EEA individuals and organisations. The EDPB stands ready to provide the European Commission with support to help it build, together with the U.S., a new framework that fully complies with EU data protection law.

Link