Certain privacy legislation restricts the cross-border transfer of personal data and some countries have introduced or are currently considering legislation that imposes local storage and processing of data to avoid any form of transfer to a third country, or other restrictions on transfer and disclosure of personal data, outside of that country. Specifically, the EEA and UK data protection laws generally prohibit the transfer of personal data to third countries, including to the U.S., unless the transfer is to an entity established in a third country deemed to provide adequate protection or the parties to the transfer implement supplementary safeguards and measures to protect the transferred personal data. Currently, where we transfer personal data from the EEA and the UK to third countries outside the EEA and UK that are not deemed to be “adequate,” we rely on standard contractual clauses (“SCCs”) (a standard form of contract approved by the EC as an adequate personal data transfer mechanism), and we are certifying with the successor to the EU-U.S. Privacy Shield Framework (“Privacy Shield”).
In the July 16, 2020 case of Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems (“Schrems II”), though the court upheld the adequacy of the SCCs, it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, as per the contractual requirement built into the EC’s new SCCs and the UK equivalent to conduct and document Data Transfer Impact Assessments addressing these issues. The Court of Justice of the European Union (“CJEU”) further stated that if a competent supervisory authority believes that the SCCs cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. Supervisory authorities have pursued enforcement in cases where they have deemed the level of protection in the destination country to be insufficient.
In July 2023, the EC published its adequacy decision for the EU-U.S. Data Privacy Framework to replace the Privacy Shield, which was invalidated by the CJEU in its Schrems II judgment. Like past transfer frameworks, the new framework is likely to be subject to legal challenges and may be struck down by the CJEU.
SCCs and other international data transfer mechanisms and data localization requirements will continue to evolve and face additional scrutiny across the EEA, the UK and other countries. We continue to monitor and update our data protection compliance strategy accordingly and will continue to explore other options for processing and transferring data from the EEA and UK, including without limitation, conducting (or assisting data exporters in conducting) assessments and due diligence of the related data flows and destination countries across our supply chain and customer base, re-evaluating and amending our contractual and organizational arrangements, all of this activity may involve substantial expense and distraction from other aspects of our business.
To the extent we are unsuccessful in establishing an adequate mechanism for international data transfers or do not comply with the applicable requirements in respect of international transfers of data and localization, there is a risk that any of our data transfers could be halted or restricted. In addition, we could be at risk of enforcement action taken by an EEA or UK data protection authority including regulatory action, significant fines and penalties (or potential contractual liabilities) until such point in time that we ensure an adequate mechanism for EEA and UK data transfers to the U.S. and other countries is in place. This could damage our reputation, inhibit sales and harm our business.