Remote Access, SCCs and the Ohio VPN
Cobalt Clinical is a Dutch company running a trial-management platform for hospital sponsors across the EU. Three data flows are under review. (1) Nightly encrypted backups go to a storage region in Frankfurt, administered by an engineering team in Ohio that holds standing VPN access to the production environment. (2) A support contract with a vendor in Pune, India, covers tier-2 tickets containing patient identifiers. (3) The HR department uses a US-headquartered HR SaaS platform for its 200 EU employees. The US vendor in flows (1) and (3) is certified under the EU-US Data Privacy Framework. A 2021 transfer impact assessment flagged FISA section 702 and EO 12333 exposure for US-based access. Cobalt's counsel argues that flow (1) is not a transfer because the data stay in the EU, and that flow (2) needs no assessment because the vendor has signed the 2021 SCCs.
1. Is flow (1) a 'transfer' for the purposes of Chapter V, given that the servers are in Frankfurt?
Read the worked answer
Yes - server location is irrelevant.
EDPB Guidelines 05/2021 set out three cumulative criteria: (a) the exporter is subject to the GDPR for the processing concerned; (b) it discloses by transmission or otherwise makes the personal data available to another controller, joint controller or processor; (c) the importer is in a third country or is an international organisation.
Standing VPN access allows engineers in Ohio to read and manipulate the production environment. That is 'making available', even though no data is stored outside the EU. Where the US entity is a separate legal person it is plainly an importer; and even where the Ohio staff are employees of the same company, the EDPB treats an entity in a third country that accesses the data as an importer, so Chapter V applies.
The contrast is useful: purely internal processing by the Dutch entity with no third-country element would not be a transfer. The distinction between a 'transfer' and mere direct applicability under Article 3(2) matters to the analysis and to the documentation, even where the practical safeguards end up looking similar.
2. What Chapter V route is available for flows (1) and (3), and what must Cobalt verify about the Data Privacy Framework?
Read the worked answer
Use the DPF where it fits - and check the scope carefully.
The EU-US Data Privacy Framework adequacy decision permits transfers to US organisations on the DPF List without SCCs or a TIA. But adequacy attaches to the certified organisation and to the categories of data and purposes its certification covers:
- Flow (3) is HR data. The certification must expressly cover the 'HR data' category; many certifications cover only non-HR commercial data, and HR data transferred to a US parent or SaaS provider is a classic trap.
- Flow (1) requires the certification to cover the relevant processing and onward transfers to any sub-processors, including the Ohio support function.
If either flow falls outside the certification's scope, the route is Article 46(2)(c) with the 2021 SCCs, a fresh transfer impact assessment and, where needed, supplementary measures. Article 49 derogations are not available as a basis for routine, repetitive flows. Given that the DPF faces legal challenge, Cobalt should also keep a documented contingency (SCCs plus supplementary measures) ready to activate.
3. Assess counsel's claim that the Pune support contract needs no assessment because the 2021 SCCs are signed.
Read the worked answer
Counsel is wrong: SCCs are a starting point, not a conclusion.
Article 46 requires appropriate safeguards and enforceable data subject rights and effective remedies. Following Schrems II, the exporter must verify that the third country's law and practice do not prevent the importer from complying, and must adopt supplementary measures where they do. Signing the 2021 SCCs without that assessment does not discharge Article 44's requirement that the level of protection not be lowered.
For the Pune vendor, the 2021 TIA flagged US surveillance law, but that analysis was about the US. India has no adequacy decision and a different legal framework, so the assessment must be specific to this vendor, its sector, its sub-processors and the data involved. Realistic supplementary measures include:
- Pseudonymising or stripping direct identifiers before transfer, with the key retained in the EU;
- Limiting tier-2 work to a de-identified ticket queue;
- EU-held or EU-controlled encryption keys;
- Contractual audit, challenge and transparency obligations with a suspension right.
Complete Module 2 SCCs (controller-to-processor) with a docking clause for sub-processors, and record the assessment under Article 30 and Article 5(2).