The Cross-Border Data Transfer After Schrems II
You are the DPO for a multinational retailer with headquarters in France. The company uses a US-based cloud provider for its customer loyalty program, which stores names, purchase history, and email addresses of 2 million EU customers. The cloud provider relies on the EU-US Data Privacy Framework (DPF) for transfers. However, you have just learned that the provider's certification under DPF is pending renewal and may lapse in 60 days. The provider also uses a subprocessor in Brazil for analytics. The French CNIL has recently increased scrutiny of transfers to the US. Your CEO wants to know if you need to suspend the loyalty program or find an alternative.
1. What are the risks and obligations regarding the DPF certification lapse, and what contingency plans should you develop?
Read the worked answer
Under GDPR, transfers to the US require a valid transfer mechanism. The DPF is an adequacy decision, so if the provider's certification lapses, the transfer becomes unlawful unless another mechanism (e.g., SCCs) is in place. You must monitor the certification status. If it lapses, you need to implement SCCs with the provider and conduct a transfer impact assessment (TIA) to evaluate US surveillance laws. The TIA may require supplementary measures (e.g., encryption with keys held in the EU). For the Brazil subprocessor, you need SCCs and a TIA for Brazil. Contingency plans: 1) Request evidence of DPF renewal and timeline. 2) Negotiate SCCs now as a fallback, with a TIA. 3) Identify alternative providers in the EU or with adequate safeguards. 4) Develop a data migration plan if necessary. 5) Communicate with the CNIL if there is a risk of lapse. Do not suspend the program prematurely; work with the provider to ensure continuity. If the provider cannot maintain a valid mechanism, you may need to suspend transfers or migrate. Document all efforts. The CNIL may expect you to demonstrate accountability. Also, consider whether the loyalty program data can be anonymized or pseudonymized to reduce risk.
2. How would you assess the adequacy of the Brazil subprocessor and what contractual clauses would you require?
Read the worked answer
Brazil has its own data protection law (LGPD) and is not subject to an EU adequacy decision. Therefore, transfers to Brazil require SCCs or binding corporate rules. You must conduct a TIA for Brazil, assessing access by Brazilian authorities and the independence of the judiciary. Brazil's LGPD is similar to GDPR, but government access laws may differ. You would require the subprocessor to sign SCCs (Module 3 for processor-to-processor) and implement supplementary measures such as encryption, pseudonymization, and transparency reports. Also, ensure the subprocessor has a DPA with the cloud provider that flows down GDPR obligations. You should review the subprocessor's security certifications and audit reports. If the TIA reveals high risk, consider alternative locations or additional safeguards. Document the assessment. The CNIL may request evidence of your TIA. Finally, update your records of processing and inform the CEO of the risk level.