• 1 Post
  • 15 Comments
Joined 2 years ago
cake
Cake day: June 16th, 2023

help-circle








  • translated with deepl:

    Information about transfers to USA

    1. What rules apply to the transfer of personal data to the US and what is an adequacy decision?

    In principle, it is not permitted to send personal data out of the EEA, but there are a number of exceptions.

    Read more about this in our guide, “Transferring personal data out of the EEA”.

    For example, you can transfer personal data to countries, territories and sectors that the European Commission has “approved” through a so-called adequacy decision.

    There is an adequacy decision for the US. It states that you can transfer personal data to US companies that are listed on this list: Data Privacy Framework List (dataprivacyframework.gov). You can read more about this adequacy decision in a news story we published in 2024. There we also explain what the rules say about the transfer of personal data to US companies that are not on the list.

    Of course, even if the transfer rules do not set specific limits, you must always follow the other rules of the General Data Protection Regulation (GDPR).

    2. Several members of the Privacy and Civil Liberties Oversight Board (PCLOB) have been removed. What is the PCLOB and what does this development mean for the US adequacy decision?

    When the European Commission adopts an adequacy decision, it looks at many different factors to ensure that personal data will be treated similarly in the country in question as in the EEA.

    In the adequacy decision for the US, the European Commission highlights the PCLOB (pclob.gov). The PCLOB monitors US intelligence authorities to ensure that individuals’ rights are not violated. This is an important element in ensuring that personal data transferred to the US is processed in a satisfactory manner.

    The US President has recently removed several of the board members of the PCLOB, and as a result there is only one board member remaining at the time this article was published. This means that right now the PCLOB is not quorate.

    The Norwegian Data Protection Authority understands that the intention is to appoint new board members to the PCLOB. Furthermore, we also understand that the PCLOB can carry out some of its tasks in the meantime even if the body is not fully constituted. Therefore, a replacement of board members does not necessarily have to be a problem. This only becomes a challenge if it takes a very long time to get new board members in place.

    The adequacy decision for the US still applies.

    Otherwise, the US laws that safeguard our personal data in the US still apply.

    3. What if there are other changes in the US?

    It is the European Commission that decides whether a country should receive an adequacy decision. The European Commission also monitors changes in laws or practices in countries that already have an adequacy decision and assesses whether the changes mean that our personal data is no longer adequately protected. If the level of protection of personal data is no longer adequate, the European Commission can withdraw adequacy decisions.

    An adequacy decision continues to apply until it is eventually revoked by the European Commission or the European Court of Justice.

    This means that any changes in the US do not automatically result in the adequacy decision lapsing. However, the European Commission will monitor such changes and consider them carefully.

    An adequacy decision also binds the data protection authorities. Data protection authorities cannot revoke an adequacy decision or prohibit transfers made in accordance with an adequacy decision.

    4. What should your business consider?

    Although we currently have rules that make it easy to transfer personal data to the US, we expect that sooner or later these rules will be challenged in the European Court of Justice. The situation in the US has also contributed to uncertainty. It’s important to be aware of this when procuring US services.

    The most important advice for your business is to have an exit strategy for what to do if you can no longer transfer personal data to the US in the same way as today. Also note that the use of US cloud services on European soil may be negatively affected if the adequacy decision is revoked.

    If an adequacy decision is revoked, there will most likely not be a transition period. In that case, we will provide more information.