There is a difference between assessing the adequacy of a third country's legislation and assessing a third country's impediments to enforcing contracts.
When taking adequacy decisions under Article 45 of the GDPR, the European Commission assesses whether the laws of a third country are, in essence, equivalent to the General Data Protection Regulation (GDPR) of the European Union (EU).
Entities that carry out international data transfers, such as data exporters, using standard contractual clauses (CCT), must assess whether there are legal impediments to complying with the CCT requirements in the legislation of the data importer's country (article 46 of the GDPR). The comment on "Schrems II" generated confusion about the differences between the Article 45 and Article 46 assessments.
When the Court of Justice of the European Union issued "Schrems II" in July 2020, there was a general conviction that the data exporter and his lawyer would be required to take an adequacy decision to ensure the transfer of data from the European Economic Area to a third country, when the appropriate guarantee is CCT. This is an incorrect reading of "Schrems II". The Article 46 assessment conducted by the data exporter is very different from the Article 45 assessment conducted by the European Commission:
The assessment of Article 45 is to check whether the laws of a third country are essentially equivalent to those of the EU. This assessment compares the laws of the third country with those of the EU to determine whether they in fact guarantee an adequate level of protection of fundamental rights and freedoms equivalent to that guaranteed in the EU .
The assessment of article 46, in turn, assesses: (1) the provisions of adequate safeguards, the CCTs, and (2) the applicability of the data subject's rights and the effectiveness of legal remedies established in the CCTs in the third country. Finally, an assessment is made of whether there is anything in the law or in the procedures of the third country that could interfere with the effectiveness of the adequate guarantee, the CCT.
If the distinctions between these two assessments are not understood, data exporters may feel that they must undertake the more complex Article 45 assessment, which is more costly and time-consuming, which may lead them to not transfer the data or even transfer the data without making the assessment. If the wrong assessment is done, they can incur unnecessary expenses (especially small and medium-sized businesses), which leads to reduced data flow. If the assessment is not carried out, any additional measures will not be identified and implemented.
This chaos negatively affects global data flows.
For more on Schrems II: https://iapp.org/news/a/confusion-about-the-meaning-of-schrems-ii-impedes-global-data-flows/
Judgement of the Court (Grand Chamber) 16 July 2020: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62018CJ0311&from=en
Comentarios