EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data

The European Data Protection Board (“EDPB”) has released draft recommendations on supplementary measures for data transfer mechanisms and corresponding European Essential Guarantees (together, the “Recommendations”). The Recommendations provide suggested steps for companies transferring personal data outside of the European Economic Area (“EEA”) to ensure that these transfers are afforded a level of protection that is essentially equivalent to what is provided in the EEA.

The Recommendations are in response to the Court of Justice of the European Union’s (“CJEU”) Schrems II decision, which invalidated the Privacy Shield as a valid data transfer mechanism in July 2020. In contrast, Schrems II upheld the validity of the standard contractual clauses, however, this is subject to the implementation of “supplementary measures” (where necessary) to ensure that transferring parties are in compliance with their respective obligations under European privacy law, particularly with respect to access requests from public authorities. The Recommendations are long-awaited and seek to define and clarify what those “supplementary measures” should be in light of these transfers.

Bitkom welcomes the opportunity to provide feedback regarding the European Data Protection Board’s “Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data”. Clear, proportionate and stable rules for the international transfer of personal data are vital for EU-headquartered companies exporting goods and services.

As Bitkom has always worked with its members and the Data Protection Authorities to further a common understanding, help implement the GDPR requirements and issued practical guidance, we have developed a concept to secure international data transfers in the light of the Schrems II decision, which we would like to put up for discussion. We therefore included the current draft state of the concept in Annex 1 (Part B) to this Position Paper, which you can download below.