The EDPB is consulting on “Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data” following the CJEU’s ruling in Schrems II (Case C-311/18 Data Protection Commissioner v Facebook Ireland Ltd). The recommendations were adopted by the EDPB at its 41^st plenary session on 9 and 10 November 2020.

The EDPB reminds readers that as a result of the Schrems II decision, data controllers relying on Standard Contractual Clauses (SCCs) are required to verify, on a case-by-case basis, and, where appropriate, in collaboration with the recipient of the data in the third country, whether the law of the third country ensures a level of protection of the personal data transferred that is essentially equivalent to that guaranteed in the European Economic Area (EEA). The CJEU allowed exporters to add measures that are supplementary to the SCCs to ensure effective compliance with that level of protection where the safeguards contained in the SCCs are not sufficient.

The recommendations seek to apply the GDPR and the Schrems II decision consistently across the EEA. They aim to assist controllers and processors acting as data exporters with their duty to identify and implement appropriate supplementary measures where they are needed to ensure an essentially equivalent level of protection to the data they transfer to third countries. The recommendations contain a roadmap of the steps data exporters must take to find out if they need to put in place supplementary measures to be able to transfer data outside the EEA and help them identify those that could be effective. To assist data exporters, the recommendations also contain a non-exhaustive list of examples of supplementary measures and some of the conditions they would require to be effective.

However, the EDPB warns, it is data exporters who are responsible in the end for making the assessment. They must proceed with due diligence and document their process thoroughly, the EDPB says, as they will be held accountable for the decisions they take on that basis, in line with the GDPR principle of accountability. Moreover, the EDPB advises, data exporters should know that it may not be possible to implement sufficient supplementary measures in every case.

The EDPB also adopted complementary recommendations on European Essential Guarantees for surveillance measures (see item below).

The consultation closes on 30 November 2020. To read the EDPB’s press release in full, click here. To read the recommendations open for consultation, click here. To provide a consultation response, click here.