USE OF THE EXCEPTIONS TO LEGITIMISE INTERNATIONAL DATA TRANSFERS

1
USE OF THE EXCEPTIONS TO LEGITIMISE
INTERNATIONAL DATA TRANSFERS

• Rosa Barcelo
• Legal advisor
• European Data Protection Supervisor

2
Overview

• Identifying Trends.
• Tips to Consider when Relying on Exceptions.
• Tips to Consider when Using Consent.
• Overall Assessment and Wishful Thinking List.

3
Identifying Trends (i)

• Use of exceptions decreasing progressively.
• Reliance on consent as an exception decreasing.
  Particularly concerning employment data.
• Increased use of contractual clauses, BCRs and
  SH.
• Likely Causes
• Increased sensitivity within companies regarding
  privacy results in the use of privacy friendly
  solutions (SH, contracts, BCRs).
• More awareness of the exceptions drawbacks (due
  to WP 29 paper 114?).
• Yet, exceptions are still widely used Have a
  look at the annual reports of some of the DP
  Agencies!

4
Identifying Trends (ii)

• Illustration of Common Reliance on Exceptions
• Hotels, travel agencies,
• Supplier/customer data, including data obtained
  on-line from Web (sweepstakes, consumer
  programs)
• On-line submission of CVs
• Stock Options, international money transfers
• Clinical trial data.
• Reasons for such Use
• Clear-cut cases
• Consent is in any case necessary on the basis of
  Art. 7 or 8
• Defective implementation of the Directive in a
  way that promotes reliance on consent.

5
Tips to Consider When Using Exceptions (i)

• Dont go to the exceptions as a first port
  analyse all the options altogether.
• Read carefully WP 29 paper 114. Extremely
  valuable!
• Be aware that significant divergences in MS
  interpretation of the exceptions persist.
• Consider that use of exceptions is easy but not
  that easy
• Some MS require notification of transfer to the
  DPA (review copies of the consent form, etc).
• Still have to comply with the Directive (inform
  individuals, etc)

6
Tips to Consider when Using Exceptions (ii)

• Consider whether you need consent ex Art. 7 8.
  In particular, if you use sensitive information.
  
• Be aware that for transfers of employment data
  (particularly if sensitive data), consent will be
  required in many MS.

7
Tips to Consider when Using Consent (I)

• If you are considering the use of consent
• Make sure that individuals can both refuse to
  give consent and withdraw it. If this happens,
  you must have a plan B.
• Be careful if you use consent together with other
  options
• Remember that in some MS you will have to notify
  the transfer to DPAs (and it may take a couple
  months to receive feedback)
• Start with a pan-European draft consent form but
  very importantly

8
Tips to Consider when Using Consent (II)

• Stay tuned to local laws!
• Some MS laws accept implicit, opt out consent
• Some MS laws/DPAs deem consent in the employment
  sector as valid
• Some DPAs accept consent for structural
  transfers
• Some DPAs require the consent to refer to the
  lack of safeguards in the third country others
  not.
• Some DPAs require independent consent, others
  dont (its still very frequent for consent not
  to be specific)
• Some MS/DPAs require consent to be in writing,
  hand signed.
• And dont forget to translate it into local
  languages!!!!

9
Overall Assessment Wishful Thinking

• Towards a decrease in the use of exceptions,
  which is positive.
• Legal situation improved after WP 29 114 paper
  (clarity harmonisation).
• Some deem WP 29 114 interpretation of the use of
  exceptions too restrictive. However, note that
  WP 29 114 positions are recommendations.
• More WP 29 papers like WP 29 114 that contribute
  to harmonisation would be welcomed.
• More work needed to ensure MS laws
  implementation is in line with Directive,
  including new MS.
• Data controllers would be glad to have an
  additional exception, similar to Art. 7 (f)
  balance of interests.

10

• rosa.barcelo_at_edps.europa.eu
• www.edps.europa.eu
• Tel [phone]
• Postal address
• Rue Wiertz 60 - B-1047 Brussels