Data transfers to the U.S. since the Schrems II judgement: An analysis seeking to integrate GAFAM and major providers in the E.U. enforcement strategy Tilburg Institute for Law, Technology and Society, Tilburg University LL.M. Law and Technology Janvier Parewyck SNR 2065486 June 2021 Supervisor: Prof. Dr. Eleni Kosta Second Reader: Dr. Irene Kamara Table of Content Chapter 1 – Introduction ...................................................................................................................... 4 1.1 Background ................................................................................................................................... 4 1.2 Problem Statement ........................................................................................................................ 8 1.3 Methodology and limitations ......................................................................................................... 8 1.4 Narrative structure ......................................................................................................................... 9 Chapter 2 – Lawfulness of data transfers in EU law up to the Schrems II judgement and the invalidation of the Privacy Shield ...................................................................................................... 10 2.1 Introduction ................................................................................................................................. 10 2.2 The GDPR regime and the ‘accountability’ principle ................................................................. 11 2.3 The notion of data transfer and the scheme of Chapter V GDPR ............................................... 12 2.4 The Safe Harbor and the Schrems I judgement: First opening of the Pandora's box .................. 14 2.5 The Privacy Shield and the Schrems II judgement: A logical follow-up .................................... 16 2.5.1 The Commission’s decision declaring that the Privacy Shield programme offered an adequate level of protection .......................................................................................................... 16 2.5.2 The comprehensive Schrems II judgement ........................................................................... 18 2.6 Conclusion: Combined judgements that are not without significance ........................................ 21 Chapter 3 – Transfer tools and technical safeguards remaining available to data controllers, and limitations thereof................................................................................................................................ 23 3.1 Introduction ................................................................................................................................. 23 3.2 The EDPB’s methodology and proposed supplementary measures ............................................ 25 3.2.1 The EDPB’s methodology .................................................................................................... 25 3.2.2 Supplementary measures ...................................................................................................... 26 3.3 First stage: Rejection, in the draft EDPB Recommendations, of the risk-based approach in the assessment of the third country law and practices ............................................................................. 29 3.4 Second stage: The new SCCs to the rescue? ............................................................................... 30 3.5 Third stage: The final EDPB Recommendations ........................................................................ 32 3.6 Conclusion: A minefield with few immediate satisfactory solutions .......................................... 33 Chapter 4 – How to enforce the European Union’s level of protection: a focus on GAFAM and US superproviders ............................................................................................................................... 35 4.1. Introduction ................................................................................................................................ 35 4.2. A look at strategies for regulating technologies ......................................................................... 36 4.3. Taking targeted enforcement actions against, and gaining compliance from, superproviders ... 38 4.3.1 Mapping of relationships between US superproviders, data subjects and EU companies ... 38 4.3.2 B2C context analysis: Consumer using the services of a US superprovider ........................ 39 4.3.3 B2B context analysis: EU-based controller using services of a US superprovider .............. 42 a. Extraterritorial applicability of the GDPR ............................................................................ 43 b. The qualification of the US superprovider as a processor and the impact on its duties and liability ...................................................................................................................................... 44 c. The necessary requalification ................................................................................................ 44 d. Going further: Longer-term consequences of such requalification ....................................... 47 4.4 Internal challenges in the EU: The efficiency of DPAs, the one-stop-shop mechanism and the coordination of fines between DPAs ................................................................................................. 49 4.4.1 The ongoing Schrems procedure .......................................................................................... 49 4.4.2 The one-stop-shop-mechanism, a device that unwittingly hinders the GDPR effectiveness 52 4.3.3 The DPAs’ fines and their coordination ............................................................................... 54 4.5 Limitations: Towards a longer-term solution with the US? ........................................................ 57 Conclusion ............................................................................................................................................ 59 Bibliography ........................................................................................................................................ 61 Acknowledgements .............................................................................................................................. 74 Chapter 1 – Introduction 1.1 Background On the 16th of July 2020, a well-known pandora's box was once again opened in the data protection sphere, bringing the question of the legality of personal data transfers from the European Union (EU) to the United States (US) to the forefront. In the so-called Schrems II ruling,1 the Court of Justice of the European Union (CJEU) declared the Privacy Shield invalid, instantly depriving of their legal basis a massive number of data transfers to no less than 5378 American companies, including Google LLC, Facebook INC and Amazon.com INC to name a few.2 The Privacy Shield, adopted by the European Commission (the Commission), formerly declared that the level of data protection in the US was sufficient to automatically allow companies to transfer personal data to self-certified US companies.3 It was not the first time that transferring personal data to the US was challenged: In 2015, the Schrems I judgement4 already invalidated the ancestor of the Privacy Shield, i.e. the Safe Harbor, hinting that keeping such transfers going in a legal way might not be as easy as hoped due to deep-rooted issues with US surveillance laws and practices. Nowadays, not only does the Internet itself, by its very nature, imply that electronic data flows from one continent to another, but companies rely on offshore IT services and Cloud infrastructures around the world, including in the US, to operate their businesses,5 resulting in ever-increasing transfers of personal data in the meaning of the General Data Protection Regulation (GDPR).6 It is therefore not surprising that European companies, and more broadly companies subject to the GDPR, have been and are still looking for ways to maintain data transfers to the US rather than shutting them down immediately. The Schrems II ruling indeed did not entirely prohibit transfers as it did not invalidate the other legal bases and safeguards on which it can be relied upon – in particular the Standard Contractual Clauses (SCCs). However, it has introduced stringent additional requirements for data exporters, which have been further developed through several guidelines of the European Data Protection Board (EDPB). Stated simply, the problem at stake goes beyond the considerations related to data transfers as such and lies in the different vision of privacy in the US and the EU or, more precisely, between the levels of protection granted. In the EU, data protection is a fundamental 1 Case C-311/18 Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems [2020] ECLI:EU:C:2020:559 2 Number of participating enterprises listed on the snapshot of 16 July 2020 of the official Privacy Shield official website; 'Privacy Shield List' (Internet Archive) <https://web.archive.org/web/20200716063154/https://www. privacyshield.gov/list> 3 Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document C(2016) 4176) [2016] OJ L 207 4 Case C-362/14