What Impact Does Schrems II Have on Cloud Migration?

More and more companies are transferring their digital business operations into the cloud, usually to run on the cloud-based infrastructure provided by a cloud service provider.

In the course of cloud migration, companies may transfer personal data to cloud providers established outside the European Union / European Economic Area and must therefore take into account the relevant applicable data protection rules related to the transfer of personal data.

According to the General Data Protection Regulation (GDPR) a transfer of personal data occurs when personal data is transferred to a country other than EU member states and the three additional EEA countries (Norway, Iceland and Lichtenstein).

Transfer to adequate third countries vs. transfer to non-adequate third countries

Any transfer of personal data to a third country must comply with the requirements laid down in the GDPR and the third country or the international organization must ensure, pursuant to Art. 45(1) of the GDPR, an adequate level of protection.

The General Data Protection Regulation (GDPR) distinguishes between third countries that provide an adequate level of protection and those that do not. The transfer of personal data to a third country, that has been recognized as providing an adequate level of protection, does not require the prior authorization of a supervisory authority and companies (data exporters) do not need to put in place any additional protection and do not have to rely on another data transfer tool such as the adoption of Standard Contractual Clauses (SCC) (SCC are contractual clauses that have been adopted by the European Commission and that ensure appropriate data protection safeguards).

According to Art. 45 (2) of the GDPR, the European Commission may adopt an adequacy decision by taking into account a range of elements such as the existence of one or more independent supervisory authorities in the third country, the international commitments the third country has entered into or the respect of human rights and fundamental freedoms. However, in the absence of such a decision, personal data may still be transferred to a third country only if the controller or the processor has provided appropriate safeguards and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. The adoption of appropriate safeguards aims at ensuring that the protection of natural persons ensured in the European Union by the GDPR is not undermined (recital 101 of the GDPR, Art. 44 of the GDPR). The adoption of Standard Data Protection Clauses (SCC) is considered as an appropriate safeguard.

Schrems II Decision & Privacy Shield

On 12 July 2016 , the European Commission adopted the adequacy decision on the EU-US Privacy Shield. The Privacy Shield was an EU-US data transfer mechanism based on self-certification by which US organizations committed to a set of privacy principles. More than 5000 US companies relied on the Privacy Shield to conduct trans-Atlantic trade in compliance with EU data protection rules . The transfer of personal data from a data exporter established in the European Union / European Economic Area to a data importer in the US was thus allowed, if the organization in question had self-certified their adherence to the privacy principles and committed to comply with them.

However, in its Judgment dated 16 July 2020 , the European Court of Justice invalidated the Privacy Shield Decision adopted by the European Commission, considering that it disregarded the requirements of Art. 45(1) of the GDPR, read in the light of Articles 7 (respect for private life and family), 8 (protection of personal data) and 47 (right to an effective remedy and a fair trial) of the Charter of fundamental rights of the European Union.

What are the impacts of the Schrems II decision on data transfers?

Since the Privacy Shield has been invalidated with immediate effect (recital 202 of the Schrems II Judgment), companies may no longer rely on the Privacy Shield to transfer personal data to an organization established in the United States. The European Court of Justice upheld however the Standard Contractual Clauses as a lawful data transfer tool but pointed out, that the sole adoption of SCC may in some cases not always be sufficient in order to guarantee the necessary protection of personal data. Pursuant to recital 133 of the Shrems II Judgement “SCC are solely intended to provide contractual guarantees that apply uniformly in all third countries to controllers and processors established in the European Union and, consequently, independently of the level of protection guaranteed in each third country. In so far as those standard data protection clauses cannot, having regard to their very nature, provide guarantees beyond a contractual obligation to ensure compliance with the level of protection required under EU law, they may require […] the adoption of supplementary measures by the controller in order to ensure compliance with that level of protection”.

In practice, it means that controllers (data exporters) that rely on SCC for the transfer of personal data to a third country are required to assess whether the law of the destination country ensures adequate protection for the personal data being transferred. This assessment is referred in the literature as a Data Transfer Risk Assessment To this end, the Controller (data exporter) must take into consideration inter alia:

• the contractual clauses agreed between the data exporter and the data importer established in the third country concerned;
• any access by the public authorities of that third country to the personal data transferred;
• and the relevant aspects of the legal system of that third country (e.g.: the rule of law, the relevant domestic legislation, data protection rules, effective and enforceable data subjects rights, the international commitments the third country has entered into etc).

If, after having conducted the assessment, the data exporter considers, that the law of the destination third country does not ensure an adequate level of protection for the personal data, supplementary measures will have to be adopted to ensure a level of protection essentially equivalent to that prescribed by EU law.

The European Data Protection Board (EDPB) issued on 18 June 2021 recommendations on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. In its recommendations, the EDPB outlined a six steps roadmap to help data exporters with the task of assessing third countries and identifying appropriate supplementary measures where needed: