Hungry for TMT news? Here is the 27th issue of the TMT Bites addressing data transfers! 

Needless to say, 2020 was a notable year for everyone, especially considering the COVID-19 pandemic. For privacy pros, however, it was (also) notable for the Schrems II judgment of the Court of Justice of the European Union, issued on 16 July of that year.

Starting from that date, European entities transferring personal data outside the EU had to implement supplementary measures aimed at ensuring that the destination country of the personal data would essentially provide the same level of protection as that guaranteed in the EU. In addition, the European Commission issued updated standard contractual clauses, and in turn many countries followed suit, updating their local data transfer rules as well as providing their own sets of standard contractual clauses.

Lastly, how could we not mention the big changes for EU-US data transfers? The White House has indeed released on 7 October 2022 an executive order implementing the EU-US Data Privacy Framework and the European Commission has announced it will prepare a draft adequacy decision and then launch its adoption procedure.

What are you waiting for? Buckle up! In this issue, we will drive you into the most recent developments in legal frameworks for data transfers, starting from Europe and then heading to the US, China, Africa and South America.

Quick off-topic: the second annual Dentons Global Artificial Intelligence Survey has just been released – go check it out at this link! We would love to receive your contributions!

If you have any questions, ask our team or send an e-mail to tmtbites.italy@dentons.com

Europe

Personal data transfers to the US – still an issue?

The new Standard Contractual Clauses provide European data exporters with clear requirements regarding international data transfers, but the new legal certainty comes with the price of additional assessment and documentation requirements. Will the upcoming Trans-Atlantic Data Privacy Framework be the easier solution for US data transfers?

Read more

UK perspective – data transfers / data sharing in a global environment

Transfers of personal data out of the UK, to “third countries” or international organizations, are restricted by the UK GDPR (as per the UK Data Protection Act 2018 and related regulations).

Post-Brexit, the UK transfers regime still largely tracks the EU GDPR’s rules. That includes the July 2020 Schrems II requirements, which also apply to transfers from the United Kingdom. However, there are some differences, and possible changes to come.

Read more

The debate over data monetization – an EU (and Italian) perspective

Directive (EU) 2019/770, otherwise known as the Digital Content Directive (DCD), has recently been implemented in Italy within the Chapter I-bis of the Italian Consumer Code. Among other things, the implementation reignited the debate over personal data monetization (i.e. the possibility for data subjects (and entities) to sell and share personal data as assets with an intrinsic economic value). Many commentators viewed the DCD as an opening to the practice of providing digital content or services in exchange for personal data (instead of a price payment). In this regard, Recital 24 of the DCD explicitly states that “digital content or digital services are often also supplied where the consumer does not pay a price but provides personal data to the trader” and that “such business models are used in different forms in a considerable part of the market.”

Read more

Data transfers under the Turkish data protection law

The rapid development of information, communication and data processing technologies in today’s globalized world brings its own challenges with regard to the governance of personal data. In this connected world, personal data can flow between entities and across borders effortlessly. This leads governments to take regulatory measures focusing on data transfers. Turkey is no exception when it comes to regulating data transfers strictly. Furthermore, various amendments in this respect have yet to be passed, potentially easing compliance requirements of the data controllers.

Read more

US

US data transfers - update 

On October 7, 2022, US President Joseph Biden issued the Executive Order On Enhancing Safeguards for United States Signals Intelligence Activities. This order bars US intelligence agencies from collecting individuals’ electronic data, including emails and text messages, transferred from Europe other than for national security purposes and requires any such collection to be proportionate and necessary.

Read more

Mainland China

Recent updates to Chinese regulations on cross-border data transfers

Cybersecurity and data protection legislation in the People’s Republic of China (PRC) has evolved quickly in recent years. Data processing activities in China are mainly regulated by the Cybersecurity Law of the PRC (effective as of 1 June 2017), the Data Security Law of the PRC (effective as of 1 September 2021) and the Personal Information Protection Law of the PRC (PIPL, effective as of 1 November 2021). The Cyberspace Administration of China (CAC), along with its local administrations, serves as the main regulator for cybersecurity and data protection issues.

Read more

China’s Personal Information Export Mechanisms: Security Assessment, Standard Contract and Protection Certification

Personal information (PI) export is a daily occurrence and a business necessity for many companies operating in China, especially for multinational companies and domestic companies using management software with servers located abroad.

We will first outline the development of China’s restrictions on PI export, then introduce PI export mechanisms provided for under the Personal Information Protection Law of the People’s Republic of China (PIPL) and finally, we suggest some practical tips.

Read more

Cross-border data transfer in China

China’s big data industry grew by almost 19 percent in 2020 compared with the previous year, reaching a market size of RMB 639 billion (US$89.8 billion)2. In light of its economic value, the significant role it plays in driving innovations and promoting convergence, and rather obscure laws and regulations on data protection, China has recently published a series of laws and regulations aimed at standardizing and promoting the protection and reasonable use of data, especially in respect of cross-border data transfers.

Read more

Complicated or simple? Determining the best approach for international companies transferring personal information outside of China

Recently, the Security assessment measures for outbound data transfers (Security Assessment Measures), the Technical specifications for the certification of cross-border processing of personal information (Security Certification Specifications) and the Provisions on standard contract for cross-border transfer of personal information (Draft for comments) (Draft Standard Contracts) were successively promulgated. They provide for three different approaches to cross-border transfers of personal information.

Read more

Outbound data transfers: Three approaches for cross-border provisions of personal data under the PRC’s new regulations

In recent years, the People’s Republic of China (PRC) has become increasingly concerned with outbound data transfers—the extranational transfer of data by data processors that was collected and generated domestically or, if stored in the PRC, data that overseas institutions, organizations or individuals can access.

The staggering RMB 8.026 billion (US$1.13 billion) penalty imposed on DiDi Global Inc. by the PRC’s internet watchdog, the Central Cyberspace Affairs Commission (CAC), was related to its cybersecurity review and indicates that outbound data transfers will become the focus of compliance.

Read more

Data transfers in a global environment: Data cross-border transfers from China

Alongside the development of the digital market in the People’s Republic of China (PRC), cross-border data transfer activities there have become increasingly frequent in recent years, while the risks of such activities have also become prominent. Passed by the National People’s Congress on 7 November 2016, the Cybersecurity Law of the PRC for the first time mandated that cross-border transfers of personal information and important data collected or generated by critical information infrastructure operators (CIIOs) may only be carried out after a security assessment of the CIIO by the Cyberspace Administration of China (CAC) and other relevant state departments.

Read more

Outbound data transfers of personal information in China

The People’s Republic of China (PRC) has built up its legal regime concerning outbound data transfers in accordance with the Cybersecurity Law of the PRC, the Data Security Law of the PRC   and the Personal Information Protection Law of the PRC (PIPL). This legal regime not only imposes restrictions on outbound transfers of personal information but also on what is defined as “important data,” subject to the data classification provided in the Cybersecurity Law and the Data Security Law. In practice, the scope of personal information can overlap with the definition of important data. Here, however, we focus simply on how to provide personal information abroad from the PRC, in particular, on the essential procedures involved.

Read more

Hong Kong 

Data transfers / data sharing in a global environment (Hong Kong)

Hong Kong is an important regional entre for many multinationals, and headquarters many cross border businesses. Potential M&A transactions (where, say, due diligence or business integration is involved) frequently involve Hong Kong group companies and result in the necessity of sharing personal data within a newly structured group, such as for example, target company employee/HR data; and data relating to target clients, including data obtained in relation to AML/KYC checks (i.e. personal data for which the target group is a controller). In addition, where digital content and online service providers store data on cloud servers in one location to save operational costs, then, if the cloud server is accessible outside of Hong Kong, such storage may constitute a transfer of personal data outside of Hong Kong.

Read more

South Africa

Cross-border data transfers under the protection of personal information Act 4 of 2013

In South Africa, privacy rights and information protection is provided for by the Protection of Personal Information Act 4 of 2013 (POPIA), which came into effect on 19 November 2013, with most of its substantive provisions coming into force from 1 July 2021. POPIA safeguards the constitutional right to privacy by protecting personal information that is processed by a “responsible party,” while at the same time maintaining the right to access information. Generally speaking, POPIA regulates the circumstances where a responsible party in South Africa transfers personal information about a data subject to a third party.

Read more

Nigeria

Cross-border transfers of personal data – the Nigerian perspective

With globalization and information sharing comes the need to protect personal data from fraudulent activities such as identity theft and hacking. Among other issues in data protection, the cross-border transfer of personal data has been a trending topic among privacy practitioners worldwide.

Read more

Mauritius

Mauritius: Data transfer provisions and the lack of data portability provisions

Thanks to the Mauritian Data Protection Act 2017 (DPA 2017), which came into force on 15 January 2018, Mauritius is among the first African countries to have data protection legislation that is generally in line with the European Union’s General Data Protection Regulation (GDPR).

Read more

Uruguay

International data transfers in a global environment – Uruguay’s recent resolutions on adequate countries and organizations

Following the ruling of the Court of Justice of the European Union (CJEU), which invalidated the European Commission’s EU-US Privacy Shield decision—generally known as the “Schrems II” decision —the Uruguayan data protection authority (URCDP) announced on 16 September 2021 its Resolution No. 23/021, under which it, too, found that the EU-US Privacy Shield was no longer considered to provide adequate levels of protection. As a result of that decision, whenever there is an international data transfer from Uruguay to any country that does not provide adequate levels of protection, the Standard Contractual Clauses that enshrine this protection must be used (as outlined in Resolution No. 41/01), or the data processor must obtain an authorization either by the data subject or the URCDP.

Read more