Following the Schrems II ruling by the Court of Justice of the European Union (CJEU), data protection authorities have been working diligently to provide guidance on transferring personal data outside the European Union. The French data protection authority, CNIL, has taken a proactive stance by publishing a comprehensive guide on Transfer Impact Assessments (TIAs) in line with recommendations from the European Data Protection Board (EDPB). This article explores CNIL’s TIA guidance and its implications for businesses.
Understanding Transfer Impact Assessments
Transfer Impact Assessments (TIAs) play a critical role in assessing the risks of transferring personal data to jurisdictions without adequacy decisions. According to CNIL’s guidance, TIAs should be conducted for each onward transfer, evaluating each step in the data transfer process. This allows organizations to identify and mitigate risks, safeguarding the privacy rights of data subjects.
Determining the Need for a TIA
CNIL’s guidance outlines a process for determining whether a Transfer Impact Assessment is required. It emphasizes involving importers in the assessment process and identifying supplementary measures collaboratively. The exporter must assess whether personal data transferred under instruments such as binding corporate rules (BCRs) or standard contractual clauses (SCCs) receive an equivalent level of protection. This ensures data is adequately protected throughout the transfer process.
CNIL’s Optional Methodology
While CNIL’s TIA guidance offers a comprehensive methodology, alternative approaches meeting GDPR requirements are also encouraged. This flexibility allows businesses to tailor their assessment processes to their unique circumstances, promoting efficiency and effectiveness.
Consultation Phase and Final Version
CNIL’s TIA guidance is currently in a consultation phase, inviting stakeholders to provide feedback. This collaborative approach ensures the final version incorporates valuable insights from industry experts. By involving stakeholders, CNIL aims to create a practical framework addressing challenges in data transfers.
Data Processors’ Obligations
CNIL’s guidance highlights data processors’ obligations in providing necessary information to the controller for GDPR compliance. This promotes transparency and accountability in the transfer process by ensuring both parties are aware of relevant legislation, practices, and circumstances.
Implications for Transfers to the US
CNIL’s TIA guidance has significant implications for transfers to the United States. With the CJEU’s ruling on the invalidity of the EU-US Privacy Shield, CNIL clarifies that a TIA is required for transfers to the US without the EU-US Data Privacy Framework (DPF). This ensures organizations are aware of additional steps needed to protect personal data when transferring it to the US.
Balancing Rights and Business Needs
While CNIL focuses on upholding EU data subjects’ rights, concerns have been raised about the lack of a risk-based and business-friendly approach. Critics argue for a balanced perspective, considering practicalities of international data transfers to avoid hindering global data flows. Balancing privacy rights and the need for seamless data transfers is crucial.
Looking Ahead
CNIL’s TIA guidance provides crucial insights and practical steps for compliance with GDPR requirements in international data transfers. The ongoing consultation process ensures a collaborative approach, encompassing a broad range of perspectives. By staying informed and participating in the consultation, organizations can shape the future of data transfers and protect the privacy rights of EU data subjects.
In conclusion, CNIL’s guidance on Transfer Impact Assessments brings clarity to data transfers. By assessing onward transfers separately and involving importers, businesses can mitigate risks. Organizations must stay updated to comply with GDPR obligations and protect the privacy rights of EU data subjects.
