Privacy & Information Security Law Blog

The Centre for Information Policy Leadership at Hunton & Williams LLP (“CIPL”) recently submitted responses to the Irish Data Protection Commissioner (IDPC Response) and the CNIL (CNIL Response) on their public consultations, seeking views on transparency and international data transfers under the EU General Data Protection Regulation (“GDPR”).

The responses address a variety of questions posed by both data protection authorities (“DPAs”) and aim to provide insight on and highlight issues surrounding transparency and international transfers.

Key takeaways from the responses include:

Transparency

• Transparency under the GDPR should be approached in a way that is user-centric and promotes effective engagement and trusted relations with individuals, rather than solely focusing on legal compliance.
• Prevalence and prominence should be given to information that is actionable or otherwise useful for individuals (to reassure them about data use or enable them to make choices).
• Data privacy supervisory authorities should incentivize and allow more flexibility and innovation in the way organizations comply and deliver transparency under the GDPR, taking into account that there are vastly different types of organizations, from startups to multinationals.
• The notice requirement should cover passively collected and observed data from an individual. Such data is collected from or on a data subject but without the data subject actively providing it to the data controller (e.g., data collection by CCTV recording, Bluetooth “beacons” or Wi-Fi tracking of the data subject). In addition, the requirement should cover data that was inferred or derived by a data controller from a set of personal data which was originally provided directly by a data subject under Article 14 of the GDPR, subject to applicable exceptions and appropriate to timing in relation to the delivery of the information under the specific data transaction.
• Organizations should add to the information requirements of the GDPR only where necessary and where this is reasonable in light of the fair processing requirement. In CIPL’s view, the point of Recital 39, which seemingly expands upon the notice requirements of Article 13 and 14, is to capture the spirit of transparency, rather than add further and more specific privacy notice elements.
• Information fatigue can be avoided, while ensuring compliance with transparency requirements, by (1) embedding transparency mechanisms as much as possible within the relevant product, service or technology; (2) providing the right amount and critical information upfront with an option to view further information; (3) delivering transparency by different methods and times, appropriate to context; (4) ensuring flexibility in how organizations provide information to individuals; and (5) utilizing the exemptions to the notice requirements.

International Data Transfers

• If Standard Contractual Clauses (“SCCs”) remain a valid transfer mechanism, they will need to be brought in line with the GDPR. Given the substantial administrative work involved, companies should be permitted to rely on their existing SCCs and be provided with a reasonable time frame for transitioning to new SCCs once they are available.
• There are currently no processor-to-processor SCCs. It is imperative that workable and commercially viable solutions are created to enable lawful transfers between EU-processors and non-EU processors and sub-processors. CIPL believes this should not necessarily be created by the EU Commission or the Article 29 Working Party/European Data Protection Board (“EDPB”), but instead that relevant industry stakeholders should lead the creation of model terms and clauses to cover processor-to-processor data transfers.
• The Binding Corporate Rules (“BCRs”) approval process should be further streamlined and improved to facilitate more expedient processing times. This means that DPAs will need to dedicate more resources to BCR review and approvals and ensure more optimal sharing of information and expertise between different DPAs on this topic.
• There are significant synergies between GDPR certification and BCRs. The two instruments are presented as separate concepts, but, arguably, BCRs are a de facto form of certification and should be leveraged and “upgraded” to GDPR certification under Articles 42 and 43 of the GDPR. Certification is a stamp of recognition that an organization is GDPR compliant; recognition should be extended to BCRs as a high and uniform level of compliance with the GDPR, as a robust privacy compliance program is a prerequisite to obtaining BCR approval. Companies that update their BCRs to comply with the GDPR should not be required to go through another comprehensive review and re-approval process, but should have a special “fast track” process for updating their BCRs in line with the GDPR and future GDPR certifications.
• If BCRs are viewed as a “badge of recognition” for a company’s privacy program and receive approval by DPAs, then any data transfers to a BCR-approved company (and also between BCR-approved companies) should be allowed based on BCR compliance by the company or companies and without any additional necessary legal transfer mechanism (e.g., SCCs or derogations).
• Developing GDPR certifications for purposes of data transfers should be a strategic priority for the Commission and/or EDPB. The ultimate goal should be to facilitate the interoperability of GDPR certifications with other transfer mechanisms such as the APEC Cross-Border Privacy Rules and other relevant certifications. Therefore, GDPR certifications, where possible, should avoid creating conflicting substantive and procedural requirements with other systems.