3 ms·

The ruling notes that standard contractual clauses are still available. Most providers offer a Data Processing Agreement that can be signed and amended to the s

The ruling notes that standard contractual clauses are still available. Most providers offer a Data Processing Agreement that can be signed and amended to the standard contract for businesses in the EU. It then gets muddy though as a DPA needs to be considered against possible legal demands of the US Gov and whether the processor will be forced to comply, assuming the data is stored unencrypted and it is possible to comply.

geewee 6y ago
Yes hopefully it'll just be some extra paperwork.
ThePhysicist 6y ago
You cannot rely on these clauses if they can't be effectively enforced, so I'm doubtful whether they will allow you transferring personal data to the US.
terom 6y ago
Quoting from the press release, the data exporter must take into account both the contractual clauses AND the surveillance laws of the target country. It is not sufficient to rely on a contract with a US data processor where the US surveillance laws do not make it possible for the recipient to comply with that contract. > In those circumstances, the Court specifies that the assessment of that level of protection must take into consideration both the contractual clauses agreed between the data exporter established in the EU and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the data transferred, the relevant aspects of the legal system of that third country. > [...] that decision imposes an obligation on a data exporter and the recipient of the data to verify, prior to any transfer, whether that level of protection is respected in the third country concerned and that the decision requires the recipient to inform the data exporter of any inability to comply with the standard data protection clauses, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the former.

geewee 6y ago

Yes hopefully it'll just be some extra paperwork.

ThePhysicist 6y ago

You cannot rely on these clauses if they can't be effectively enforced, so I'm doubtful whether they will allow you transferring personal data to the US.

terom 6y ago

Quoting from the press release, the data exporter must take into account both the contractual clauses AND the surveillance laws of the target country. It is not sufficient to rely on a contract with a US data processor where the US surveillance laws do not make it possible for the recipient to comply with that contract. > In those circumstances, the Court specifies that the assessment of that level of protection must take into consideration both the contractual clauses agreed between the data exporter established in the EU and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the data transferred, the relevant aspects of the legal system of that third country. > [...] that decision imposes an obligation on a data exporter and the recipient of the data to verify, prior to any transfer, whether that level of protection is respected in the third country concerned and that the decision requires the recipient to inform the data exporter of any inability to comply with the standard data protection clauses, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the former.