From May 2018, the General Data Protection Regulation (GDPR) will apply to all international organisations that process EU residents’ data. Companies will therefore be required to make significant changes in data subject consent, privacy by design, data breach notification and in several other areas in order to comply with the Regulation and transfer data internationally.
A large number of delegates attending IT Governance’s GDPR webinars had questions related to international transfers of EU residents’ personal data under the GDPR, the impact Brexit will have on organisations in the UK, and the privacy considerations companies need to take into account when transferring data from Europe to the United States.
In this blog post, IT Governance’s GDPR expert answers our attendees’ most frequently asked questions to shed light on some of the GDPR requirements for international transfers.
If processing or controlling EU residents’ data but the processing/controlling takes place in the USA, how does the GDPR apply? Is the GDPR global or EU only?
Article 3 of the GDPR sets the territorial scope of the Regulation to apply to both:
- [Article 3(1)] the processing of personal data in the context of the activities of a controller or processor in the Union, regardless of whether the processing itself takes place in the Union; and
- [Article 3(2)] the processing of personal data of data subjects within the Union by a controller or processor established outside the Union where the processing relates to either the offering of goods or services, or to the monitoring of EU data subjects’ behaviour within the Union.
This means that organisations that are not established in the EU but offer goods or services to individuals in the EU, or monitor their behaviour, will be required to comply with the GDPR.
The UK government has confirmed that, in line with its treaty obligations, the GDPR will apply in the UK from 25 May 2018.
The working assumption must, therefore, be that Brexit will have no impact on how the Regulation is applied. Reality, though, doesn’t always follow logic, so the only practical advice at the moment is to proceed on the basis that the GDPR will work as intended but to keep abreast of developments in the field over the next 18 months.
If somebody is living in the EU but is not actually an EU citizen (e.g. an expat), does the GDPR still apply?
Yes – when you travel abroad, you are subject to the laws of the country you travel to. Similarly, when you are living in the EU, your personal data is covered by its laws and regulations.
Is signing up to the EU-US Privacy Shield sufficient to satisfy the GDPR processing clauses?
No – the EU-US Privacy Shield is purely for protecting personal data under the Data Protection Directive (DPD) in transatlantic data flows. Its scope differs from that of the GDPR, particularly with regard to legal obligations around the processing, handling, collecting, etc. of personal data.
Moreover, the EU-US Privacy Shield is subject to annual review, and is therefore likely to change. This provides limited certainty with regard to data protection. This factor, combined with the drastically different data protection culture in America and in light of the GDPR principle of adequacy, means it is highly unlikely that current EU-US Privacy Shield conformance will suffice for GDPR compliance. US organisations that are within the scope of the GDPR should proceed on the basis that they, too, will have to fully comply with the Regulation’s requirements.
Is there flexibility to comply with the GDPR, or must all EU countries implement the Regulation exactly as written?
There is very little flexibility. The GDPR is a form of EU legislation known as a regulation. Within the EU, regulations are directly applicable in every Member State, and the GDPR will be directly binding on all Member States from 25 May 2018. No further legislation is required to implement the GDPR, and one of the Regulation’s drivers is to ensure the standardisation of data protection regimes across the EU.
However, some articles within the GDPR permit Member States a degree of flexibility. Member States can, for instance, vary the definition of special categories of data and the age they deem to be the threshold for a minor in relation to information society services.
What will the procedure be for gaining an adequacy rating, e.g. for an international organisation? Is it acceptable to use Cloud providers in the USA so long as there is a business contract in place that provides protection?
The rules regulating international transfers of data under the GDPR have much in common with the rules under the DPA in the UK (except that organisations are now limited in their ability to transfer data on the basis of their own adequacy assessment). It’s important to remember that there are two primary objectives to the GDPR, and one of those is facilitating the free movement of data. The GDPR thus clarifies some of the procedures for international data transfers that were contained in the DPD.
The adequacy of protection levels associated with a particular transfer may be ensured by:
- Use of model contract clauses;
- Use of binding corporate rules governing intra-group data transfers; or
- Reliance on an exemption.
For international organisations, these will still be legitimate options for international data transfers.
In addition to this, transfers may be made where the Commission decides that a third country, territory, one or more specific sectors in a third country, or an international organisation ensures an adequate level of protection. This is beneficial, since it means that organisations designated as adequate by the Commission will not need to obtain further authorisation for individual transfers.
Adequacy decisions are subject to a periodic review, in which the Commission consults with the entity and considers relevant developments in the entity and information from other relevant sources. Adequacy decisions therefore may involve some type of audit of the international organisation. The procedure for deciding adequacy is likely to involve the opinions of supervisory authorities, as well as the EDPB, and approval through an examination by the Article 31 Committee before the decision is adopted by the College of Commissioners.
What impact will Brexit have on the choice of the supervisory authority?
None: the ICO will remain the supervisory authority of the UK. NB: the UK government has confirmed that, regardless of the Brexit negotiations, the GDPR will apply in the UK. The GDPR already allows organisations to select a lead supervisory authority on the basis of the member state within which it has a permanent establishment or which is the location of a significant part of its processing, and it’s difficult to see this option not being available to UK companies post-Brexit.
In case of US-based companies, would NIST 800 controls cover the GDPR requirements? If so, how much: fully or partially?
There’s no reason not; the NIST 800 publications include a good set of controls that are likely to offer coverage of all the relevant data risks.
How can the GDPR be enforced against third-country organisations? Surely the ICO couldn’t fine a company in China.
Non-EEA controllers have to appoint an EU representative – that’s the first step for a regulator in an enforcement action.
What would happen if an organisation outside the EU refused to pay the fine, believing they are outside the EU’s jurisdiction?
Enforcement action, under international treaties.
Is a server that is shared with a company in the US classed as transferring data if the server is in the UK? What about Cloud environments based within the EU but logically supported from technical support staff based outside the EEA? If the data is not exported but viewed from third countries, does the GDPR still apply?
If a third country, company or person can access data on a UK/EU server, then you are giving access to someone outside the EEA – you are allowing processing by someone outside the EEA. ‘Consultation’ and ‘use’ of data are explicitly included in the definition of ‘processing’.
In terms of practical implementation, would GDPR compliance be better led by information assurance professionals or legal/policy teams?
Usually better if led by practitioners – with lots of legal input and advice. What matters is how you implement the legal requirements, rather than how well you reflect them in your documentation.
How should companies and internal DPOs proceed in multinational companies that reach out to countries that currently do not have DP regulation or have regulations that conflict with the GDPR? Many US companies require end user details to ensure compliance with US tech laws. They are not GPDR-compliant – how will this be resolved?
International companies will be able to deal with this through the use of binding corporate rules.
Hi what about an EU citizen who is working abroad in e.g USA. Does the American company have to protect that citizen’s rights according to GDPR?
Hi Jim,
Technically, they do. The GDPR applies to all EU citizens, regardless of where that data is held or used.
Luke, everything I’ve read about GDPR states “EU Resident” not “citizen”. Which means this would not apply to EU Expats living outside of the EU. Where have you seen “citizen” used?
Hi Thomas,
The actual text uses neither ‘resident’ nor ‘citizen’. But the GDPR has been interpreted to refer to anyone who is in the EU; that typically means residents, but it also refers to tourists/visitors. It also refers to EU citizens who aren’t in the EU (temporarily or permanently).
I don’t even know how I finished up here, however I thought this put up was good.
I don’t recognize who you might be but certainly you’re going to a well-known blogger if
you aren’t already. Cheers!
Great article – thanks. One item I didn’t see addressed is the case where a EU Citizen is living abroad. Are they, in this case, still covered by GDPR? For example, let’s say John Smith was born in, and has citizenship in, France. However, John Smith moved to Atlanta, GA in 2008. In this case, John is a resident of the USA, but a citizen of France. All interactions “Company ABC” have had with John Smith have been during the time that John Smith lived/resided in the USA. Is Company ABC’s information on John Smith covered under GDPR in this case?
Technically, they are. The GDPR applies to all EU citizens, regardless of where that data is held or used.
Luke – by way of an alternative opinion (IANAL) the legal text does not mention citizen only resident. In Jason’s example, if Frenchman John Smith moved to Atlanta and this is the first time Company ABC collects his personal data then since he is not resident in a EU Member State GDPR does not apply. If ABC collected the personal data when John Smith was in France then this transfer of data to the US is subject to the GDPR. (See Recital 101).
Hi Colin,
Technically, neither ‘resident’ nor ‘citizen’ are used. But the GDPR has been interpreted to refer to anyone who is in the EU; that typically means residents, but it also refers to tourists/visitors. It also refers to EU citizens who aren’t in the EU (temporarily or permanently).
Hi Luke, what would be the applicability of GDPR to a non-EU supplier of an Irish company in circumstances where that the Irish company has entered into an agreement with another EU company to provide a service. Part of that service requires the Irish company to push personal data of non-EU citizens to a non-EU supplier who then processes the non-EU citizen data to provide the service to the Irish based company. On the basis that the Irish company is an EU-established company (and consequently the rules of establishment), I am assuming GDPR applies but should that Irish company insist that the non-EU supplier process non-EU citizen data to GDPR standards?
Hi David,
There are two issues here. Regarding third parties and suppliers: the GDPR states that organisations are responsible for the security of third parties. However, the GDPR doesn’t apply to non-EU residents’ personal data. There are no requirements to protect non-EU residents’ data with the same rigour as EU residents.
If an organisation wants its third parties to follow the same precautions for all personal data, it can — but a data breach of non-EU residents’ personal data isn’t punishable under the GDPR.
Hi, I wanted to know how/if the GDPR will apply if we as a company(Outside the EU) sell and app to an organization and the employee(being in EU/ouTside the EU) of the organisation provides the following information: 1. his name 2. his organisation email id 3. his designation in the organisation.
Also, we have a website that can be accessed by anyone anywhere and we have a form for collecting the visitors name and email id. Will the GDPR apply if an EU resident provides this information? Does he consent just by providing this information on his own?
To answer your first question: the information is considered personal data, but the GDPR only applies if (a) the employee is an EU resident, and (b) your organisation stores the information in a filing system.
Your second question: it would be almost impossible to determine whether a visitor to your site was within the GDPR’s scope, so it’s advisable to create a single GDPR-compliant form that everybody uses. You would need to explain a number of things, such as what you plan to do with the information and how long it will be retained. You can read more on our blog- https://www.itgovernance.eu/blog/en/how-to-create-gdpr-compliant-consent-forms.
As a business outside of the EU must we comply to GDPR if we deal with European suppliers?
Hi Rian,
Only if you collect EU residents’ personal data (including information belonging to the suppliers’ employees).
Great article thank you!
I had a question: what is the applicability of GDPR in the scenario below:
Personal data of a person who is a citizen of (and resident in) a country outside the EEA is collected directly from them by a company established in the same country. That data is then transferred to another company within the EEA, who then transfers the same data outside of the EEA again. Both companies are data controllers and process the data in question at each stage.
When will GDPR “bite” (or does it at all)? Obviously the EEA based data controller will be subject to GDPR, but what rights would the non-EEA citizen have under GDPR? Thanks!
Hi Adam,
The data that’s collected doesn’t belong to an EU resident, so technically the GDPR doesn’t apply. That said, all EU-based organisations should have adopted a GDPR-compliant system for storing data, so the information will be stored in compliance with the Regulation.
Maybe a silly question here . . .
How does a web form logically validate an “EU Citizen” segment vs anyone else on the planet? Or should the form simply treat all users with the same opt-in dialog and backend processing?
There’s entire federal agencies that struggle to determine citizenship or residency.
Hi Mike,
You’re right; it’d be unfeasible to work out whether visitors were within the GDPR’s scope. Thus, organisations would probably be best of using the same GDPR-compliant for all their customers.
If my data centre is in the UK and all data is stored there, will it be violating the data residency needs for my European customers? I have explicitly mentioned that all information is being stored in the UK DC.
The UK is (for now) still in the EU, so you’re fine. What happens after March 2019 is one of myriad unknowns of Brexit.