Navigating Cross-Border Data Transfers Under GDPR

The General Data Protection Regulation (GDPR) was enacted in 2016, becoming enforceable in May 2018. It introduced far-reaching changes to how organisations handle and transfer personal data. One of the most significant aspects of GDPR pertains to cross-border data transfers. As global commerce and digital services transcend geographical boundaries, data often flows across borders. The GDPR lays out stringent requirements for ensuring that personal data remains protected, even when transferred outside the European Economic Area (EEA).

This guide will comprehensively cover the fundamental principles, mechanisms, challenges, and strategies for navigating cross-border data transfers under the GDPR. We will discuss the key elements of lawful data transfers, the risks involved, and best practices to ensure compliance with the GDPR’s cross-border data transfer regulations.

Table of Contents

Understanding Cross-Border Data Transfers under GDPR

Before diving into the specifics, it is crucial to understand what constitutes a cross-border data transfer under the GDPR. A cross-border transfer refers to the movement of personal data from one jurisdiction to another, typically outside the EEA. The EEA consists of the EU member states and three additional countries: Iceland, Liechtenstein, and Norway. Any transfer of personal data to a country outside this zone is considered a cross-border data transfer under GDPR and, therefore, subject to its rules.

The GDPR recognises that transferring personal data to third countries (outside the EEA) poses significant privacy risks because those countries may not have equivalent levels of data protection. As a result, the regulation imposes strict conditions to ensure that personal data remains protected when transferred internationally.

Key Elements of Cross-Border Data Transfers under GDPR

When transferring personal data across borders under the GDPR, several key factors must be considered:

Adequate Level of Protection: The GDPR aims to ensure that personal data transferred outside the EEA is protected with the same level of security as within the EEA. This can be achieved if the third country offers an adequate level of protection for personal data, as determined by the European Commission.
Appropriate Safeguards: If a country does not have an adequacy decision from the European Commission, data controllers and processors must use additional measures, such as appropriate safeguards, to ensure the protection of personal data during cross-border transfers. These safeguards may include binding corporate rules (BCRs), standard contractual clauses (SCCs), or certification mechanisms.
Specific Exceptions: The GDPR provides several derogations for specific situations where cross-border transfers can occur, even without adequacy decisions or appropriate safeguards. These exceptions are limited in scope and apply only in specific, defined circumstances.
Accountability and Documentation: Organisations must maintain records of data transfers and be able to demonstrate that they have taken all necessary steps to protect personal data during cross-border transfers. Accountability and transparency are core principles of GDPR compliance.

Adequacy Decisions: Simplifying Cross-Border Transfers

One of the simplest ways to ensure compliance with the GDPR’s cross-border transfer rules is through an adequacy decision. The European Commission can determine that a country, territory, or international organisation offers an “adequate level of protection” for personal data. This decision allows data to flow freely between the EEA and the third country without additional safeguards.

How Adequacy Decisions Work

An adequacy decision essentially means that the European Commission has evaluated the data protection laws of a third country and found them to be sufficiently protective of personal data. Once an adequacy decision is in place, personal data can be transferred to that country without the need for additional measures.

Countries with adequacy decisions currently include:

Canada (commercial organisations)
Japan
Switzerland
Israel
Uruguay
New Zealand
South Korea
The United Kingdom (following Brexit)

The adequacy decision process is dynamic, and the European Commission can review or revoke it if a country’s data protection landscape changes. For example, the United States had an adequacy decision under the Privacy Shield framework, but this was invalidated by the Court of Justice of the European Union (CJEU) in July 2020 in the landmark Schrems II ruling.

Challenges and Limitations of Adequacy Decisions

While adequacy decisions can simplify cross-border transfers, they have limitations. Only a handful of countries have received adequacy decisions, meaning organisations may frequently encounter situations where adequacy does not apply. Additionally, adequacy decisions can be subject to legal and political challenges, as demonstrated by the Schrems II decision.

For organisations engaging in cross-border transfers with countries lacking an adequacy decision, additional mechanisms are required.

Appropriate Safeguards for Cross-Border Transfers

In the absence of an adequacy decision, the GDPR requires organisations to implement appropriate safeguards to ensure that personal data is protected during cross-border transfers. The most commonly used mechanisms are Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs).

Standard Contractual Clauses (SCCs)

SCCs are pre-approved legal agreements that organisations can use to transfer personal data outside the EEA. These clauses outline specific obligations for both the data exporter (within the EEA) and the data importer (outside the EEA) to ensure that personal data is adequately protected.

In June 2021, the European Commission issued updated SCCs to reflect the GDPR’s requirements and address the challenges posed by the Schrems II ruling. The new SCCs are modular, allowing organisations to tailor them to specific transfer scenarios, such as controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller transfers.

While SCCs provide a widely used and practical mechanism for cross-border transfers, they come with some challenges. The Schrems II decision highlighted the need for data exporters to conduct case-by-case assessments of the laws and practices of the destination country. If the legal framework of the importing country undermines the protection of personal data, additional measures may be required.

Binding Corporate Rules (BCRs)

BCRs are another mechanism for ensuring lawful cross-border data transfers under the GDPR. BCRs are internal policies adopted by multinational companies to govern data transfers within the group. They are approved by data protection authorities (DPAs) and allow personal data to be transferred across borders within the company.

Unlike SCCs, which are standardised contracts between two parties, BCRs are customisable and tailored to a specific company’s structure and operations. This flexibility makes BCRs particularly useful for large multinational organisations that engage in frequent cross-border data transfers.

However, implementing BCRs is a more complex and time-consuming process than using SCCs. BCRs must undergo a rigorous approval process from DPAs, which can take months or even years. As such, they are typically used by large companies with extensive global operations.

Other Safeguards: Codes of Conduct and Certification Mechanisms

In addition to SCCs and BCRs, the GDPR provides for other mechanisms to facilitate cross-border transfers, such as approved codes of conduct and certification mechanisms. These mechanisms allow organisations to demonstrate their commitment to data protection principles and facilitate data transfers in a compliant manner.

However, the development of such mechanisms is still in its infancy, and there are few approved codes of conduct or certification schemes currently in use. As these mechanisms mature, they may offer additional options for organisations seeking to comply with GDPR’s cross-border transfer requirements.

Derogations: Specific Situations Allowing Transfers

In certain circumstances, the GDPR permits cross-border transfers without adequacy decisions or appropriate safeguards. These exceptions, known as derogations, are limited in scope and apply only to specific situations.

The most common derogations include:

Explicit Consent: The data subject has explicitly consented to the transfer after being informed of the risks involved. This derogation requires the data subject’s clear and informed consent and is not a blanket authorisation for transfers.
Contractual Necessity: The transfer is necessary for the performance of a contract between the data subject and the data controller or for the implementation of pre-contractual measures taken at the data subject’s request.
Public Interest: The transfer is necessary for reasons of public interest, as recognised by EU or member state law.
Legal Claims: The transfer is necessary for the establishment, exercise, or defence of legal claims.
Vital Interests: The transfer is necessary to protect the vital interests of the data subject or another person when the data subject is physically or legally incapable of giving consent.

These derogations are exceptions to the rule, not a primary basis for cross-border transfers. Organisations should use them sparingly and ensure that transfers relying on derogations are well documented.

The Impact of the Schrems II Ruling

The Schrems II ruling by the CJEU in July 2020 had a profound impact on cross-border data transfers, particularly with respect to the United States. The ruling invalidated the EU-US Privacy Shield, a framework that had previously allowed companies to transfer personal data to the US while ensuring compliance with EU data protection standards.

The CJEU found that the US surveillance laws did not provide adequate protection for personal data, particularly in light of the rights of data subjects under EU law. As a result, companies could no longer rely on the Privacy Shield for cross-border transfers.

However, the court upheld the use of SCCs, provided that data exporters conduct an assessment of the importing country’s legal framework. This requirement has placed a significant burden on companies, particularly those transferring data to countries with extensive surveillance laws, such as the US.

Practical Implications of Schrems II

The Schrems II decision has made it more challenging for organisations to transfer data to countries without adequacy decisions, especially the US. Companies must now assess whether the destination country provides sufficient protections for personal data and, if necessary, implement additional safeguards, such as encryption or anonymisation.

The ruling also led to a surge in the adoption of privacy-enhancing technologies (PETs), which help organisations minimise the risks associated with cross-border transfers. These technologies include pseudonymisation, encryption, and data minimisation techniques.

Organisations must stay vigilant in monitoring legal developments in this area, as ongoing negotiations between the EU and the US could lead to a new framework for data transfers.

The Role of Data Protection Authorities (DPAs)

Data protection authorities play a crucial role in overseeing cross-border data transfers. They are responsible for approving mechanisms such as BCRs, investigating complaints, and enforcing compliance with the GDPR. DPAs also provide guidance to organisations on how to navigate the complexities of cross-border transfers.

The GDPR introduced the concept of a “lead supervisory authority” for organisations operating in multiple EU member states. This mechanism allows organisations to work with a single DPA to ensure consistent enforcement of the GDPR across all member states.

DPAs have the power to issue fines and sanctions for non-compliance with GDPR’s cross-border transfer requirements. The fines can be substantial, reaching up to €20 million or 4% of a company’s global annual revenue, whichever is higher. As such, organisations must take their cross-border transfer obligations seriously and ensure they have robust compliance programmes in place.

Best Practices for Ensuring Compliance with Cross-Border Data Transfers

Navigating the GDPR’s requirements for cross-border data transfers can be complex, but following best practices can help organisations mitigate risks and ensure compliance:

Conduct a Data Transfer Impact Assessment (DTIA): Before engaging in cross-border data transfers, organisations should conduct a thorough assessment of the risks involved. This assessment should evaluate the legal framework of the destination country and the potential impact on data subjects’ rights and freedoms.
Use Approved Transfer Mechanisms: Where possible, rely on mechanisms such as adequacy decisions, SCCs, or BCRs to ensure that data transfers are lawful. If these mechanisms are not available, consider using derogations, but ensure they are used in limited, clearly defined circumstances.
Monitor Legal Developments: The legal landscape for cross-border data transfers is constantly evolving, particularly in light of court decisions such as Schrems II. Organisations should stay up to date on legal developments and adjust their transfer practices accordingly.
Implement Technical and Organisational Measures: To mitigate the risks of cross-border transfers, organisations should implement strong technical and organisational measures, such as encryption, pseudonymisation, and data minimisation. These measures can help protect personal data even if it is transferred to a country with weaker legal protections.
Ensure Transparency and Accountability: Organisations must be transparent with data subjects about cross-border transfers and ensure they have appropriate documentation in place to demonstrate compliance. Maintaining clear records of data transfers and the safeguards in place is crucial for demonstrating accountability under the GDPR.
Engage with DPAs: In cases where cross-border transfers are complex or high-risk, it may be beneficial to engage with data protection authorities for guidance. DPAs can provide valuable insights and help organisations navigate the complexities of cross-border data transfers.

Conclusion

Cross-border data transfers are a critical aspect of global commerce and digital services, but they come with significant challenges under the GDPR. Organisations must carefully navigate the rules and requirements to ensure that personal data remains protected, even when transferred outside the EEA.

By understanding the key elements of lawful cross-border transfers, using appropriate safeguards, and staying informed about legal developments, organisations can successfully navigate the complexities of cross-border data transfers under GDPR. Adopting best practices and engaging with data protection authorities can further enhance compliance and minimise the risks associated with international data flows.