ANALYSIS: Irreplaceable? Data Transfer to U.S. May Get Thumbs Up

If you collect the personal data of individuals from the EU “in the box to the left” and transport it across the Atlantic to the U.S., the transfer may still pass muster in the wake of the Schrems II decision—provided your U.S.-based service provider is “irreplaceable.”

So says the Data Protection Authority of the German state of Baden-Wuerttemberg (LfDI Baden-Württemberg) in a press release and guidance published Aug. 25.

And what service provider (or at least, what marketing department of a service provider) wouldn’t think of its offerings as “irreplaceable”?

In Schrems II, the Court of Justice of the European Union (CJEU) invalidated the EU-U.S. Privacy Shield and imposed new obligations on data exporters who transfer personal data from the EU to so-called third countries, like the U.S., via standard contractual clauses (SCCs). The CJEU said that data exporters must make case-by-case assessments to ensure that the law of the third country offers a level of protection “essentially equivalent” to the GDPR. If the assessment comes up short, companies must provide “additional safeguards” to those offered by the SCCs themselves.

Thanks to guidance subsequently released by the European Data Protection Board, data exporters must also apply case-by-case assessments and additional safeguards when using another transfer mechanism, known as binding corporate rules (BCRs).

Any transfers failing to meet these requirements must be halted.

The CJEU made clear that U.S. law does not ensure an adequate level of protection, but what if the data exporter has no other option? What if the U.S. service provider is (dare we say) “irreplaceable”?

That’s where LfDI Baden-Württemberg shines a little ray of hope.

While noting that a change in U.S. surveillance law would be the perfect solution (“die perfekte Lösung”), LfDI Baden-Württemberg acknowledges that such an outcome is unlikely.

Therefore, in the absence of perfection, LfDI Baden-Württemberg will apply the principle of proportionality to cross-border transfers, asking whether there are reasonable alternatives (“zumutbare Alternativangebote”) to data transfers to the U.S. If a company, however, can convince the supervisory authority that a U.S.-based service provider is irreplaceable (“unersetzlich”), the transfer may proceed, at least for the foreseeable future.

Such a pronouncement should provide some relief for data exporters—along with renewed incentive for certain marketing departments to show how their services are “irreplaceable.” (Cue Beyoncé.)

If you’re reading this on the Bloomberg Terminal, please run BLAW OUT <GO> in order to access the hyperlinked content.