European Commission Issues New SCCs for Data Transfers to Third Countries

By Christopher Foo, Lore Leitner, Jan Dhont, Christopher Olsen, Cédric Burton and Alexandre Lépine on November 17, 2020 Posted in European Union, Privacy

On November 12, 2020, the European Commission (EC) issued a draft version of a new set of Standard Contractual Clauses (New SCCs). The long-awaited New SCCs include several modules that companies can use depending on the transfer scenarios, such as controller-to-controller, controller-to-processor, and processor-to-processor data exports. The New SCCs have also been updated to reflect the high standard for data protection set forth in the General Data Protection Regulation (GDPR) and to take into account the requirements resulting from the Schrems II ruling. Continue Reading

EDPB Publishes Draft Recommendations on Supplementary Measures for Data Transfers

By Christopher Foo, Alexandre Lépine, Cédric Burton, Lore Leitner, Jan Dhont, Christopher Kuner, Christopher Olsen and Maximin Orsero on November 12, 2020 Posted in Cybersecurity, European Union, Privacy, Regulatory

On November 11, 2020, the European Data Protection Board (EDPB), comprised of the European data protection regulators (DPAs), issued two long-awaited sets of recommendations. These recommendations are critical for any companies exporting or importing EU personal data. Continue Reading

The CJEU Condemns Broad Data Access by UK, French, and Belgian Law Enforcement and Intelligence Services

By Jan Dhont, Nikolaos Theodorakis and Maximin Orsero on November 10, 2020 Posted in European Union, Privacy

In a long anticipated ruling, the Court of Justice of the European Union (CJEU) confirmed on October 6, 2020 (joint-cases C-623/17 and C-511/18 et seq., “Ruling”) that general and indiscriminate transmission or retention of traffic and location data for law enforcement and national security purposes breaches EU law. Continue Reading

France’s Administrative High Court Greenlights Microsoft’s Hosting of Health Data in Face of CNIL’s Schrems II Concerns

By Jan Dhont, Christopher Olsen, Alexandre Lépine and Maximin Orsero on November 10, 2020 Posted in European Union, Privacy, Regulatory

On October 13, 2020, France’s high administrative court (Conseil d’État, “the Court”) rejected a request to suspend France’s centralized health data platform—the Health Data Hub—currently hosted by Microsoft in its data center in the Netherlands.

In essence, the Court rejected the French DPA’s (CNIL) argument that in light of the important public interest of maintaining a COVID-19 related health database, the risks of access by U.S. authorities, although real, do not justify the suspension of the platform. The judgment provides useful insights in light of the recent Schrems II ruling for organizations transferring health data outside of the EU^[1] (for more information on the Schrems II ruling, see our blog post ECJ Invalidates EU-U.S. Privacy Shield and Upholds the Standard Contractual Clauses). Continue Reading

CNIL Issues Updated Cookie Guidance

By Cédric Burton, Jan Dhont, Lore Leitner and Alexandre Lépine on October 7, 2020 Posted in European Union, Privacy, Regulatory

On October 1, 2020, the French data protection authority (the CNIL) issued the final version of its guidelines on the use of cookies and other trackers (the Guidelines), replacing a first draft published on July 4, 2019. While the main principles remain unchanged, this version provides further practical guidance for website and mobile application publishers using cookies and trackers. The CNIL indicated that the deadline for compliance with the new rules should not exceed six months, which means that companies have until March 2021 to ensure compliance. Continue Reading

U.S. Government Publishes White Paper on International Data Transfers Following Schrems 2.0 Judgment

By Jan Dhont, Nikolaos Theodorakis and Roberto Yunquera Sehwani on October 7, 2020 Posted in Privacy, Regulatory

On September 28, 2020, the U.S. Department of Commerce (DoC) published a white paper co-authored by the U.S. Department of Justice (DoJ) and the Office of the Director of National Intelligence (white paper)^[1] which provides information on the safeguards under U.S. law to limit the collection of data from private companies by U.S. intelligence services. The white paper addresses concerns raised by the EU Court of Justice (ECJ) when it invalidated the EU-U.S. Privacy Shield framework (Privacy Shield) and imposed certain conditions on the use of Standard Contractual Clauses (SCCs). Continue Reading