I85PREP
⌘ K
ICDL Data Protection study materials
ICDL Data Protection study resources

ICDL Data Protection (ICDL): The Cross-Border Transfer Trap

ICDL Data Protection · Put your knowledge to work in context.

All case studies

The Cross-Border Transfer Trap

Global Retail Inc., headquartered in the EU, uses a customer support center in India operated by a subsidiary. The subsidiary handles customer inquiries and has access to EU customers' personal data (names, addresses, purchase history). The EU company has a contract with the Indian subsidiary that includes standard data protection clauses. However, the Indian subsidiary also uses a cloud-based CRM system provided by a US company. The CRM data is stored on servers in the US. The EU company has not conducted a transfer impact assessment (TIA) for the US transfer. In February, the US provider notified the EU company that it had received a government request for access to data stored on its servers. The EU company is unsure whether it can continue to use the CRM and whether it must notify customers or the supervisory authority.

1. What are the legal issues with the data transfers to India and the US?

Read the worked answer

Transfer to India:

  • The transfer to the Indian subsidiary is a transfer to a third country. The EU company relies on Standard Contractual Clauses (SCCs) as a transfer mechanism. However, SCCs alone are not sufficient; the EU company must also conduct a Transfer Impact Assessment (TIA) to evaluate the laws and practices of India, particularly regarding government access to data. If the TIA reveals that Indian law does not provide essentially equivalent protection, additional safeguards (e.g., encryption, pseudonymization) may be needed. The facts do not mention a TIA for India, so this is a potential gap.

Transfer to the US:

  • The US transfer is more problematic. The CRM data is stored in the US, and the US provider is subject to US laws (e.g., FISA, CLOUD Act) that may allow government access. The EU company has not conducted a TIA for the US, which is required under the Schrems II ruling. Without a TIA and additional safeguards, the transfer is likely unlawful. The US provider's notification of a government request confirms that such access is a real risk.

Key issues:

  1. Lack of TIA for US transfer: The EU company must assess the US legal framework, the likelihood of government access, and the effectiveness of any supplementary measures. If no adequate safeguards exist, the transfer should be suspended.
  2. SCCs alone insufficient: SCCs are a tool, but they do not override local laws. The company must ensure that the importer can comply with the SCCs and that any government access is minimized.
  3. Government access request: The US provider received a request. The EU company must ensure that the provider challenges unlawful requests and discloses only the minimum necessary. The provider should notify the EU company (unless prohibited), and the EU company should assess the impact.
  4. Accountability: The EU company remains responsible for the data and must be able to demonstrate compliance.

Conclusion: Both transfers require a TIA. The US transfer is high-risk and may need to be suspended unless additional measures (e.g., strong encryption where the provider cannot access keys) are implemented.

2. What actions should Global Retail Inc. take in response to the US government access request and the overall transfer situation?

Read the worked answer

Immediate actions regarding the government request:

  1. Assess the request: Determine the legal basis, scope, and urgency. The US provider should be asked to provide details (if permitted) and to challenge the request if it is overbroad or unlawful. The EU company should support the provider in resisting disproportionate requests.
  2. Notify relevant parties: If the request could lead to unauthorized access to personal data, the EU company should consider whether it is a personal data breach. Under GDPR, a government access request may not be a breach per se, but if data is accessed without a lawful basis, it could be. The company should assess the risk and, if necessary, notify the supervisory authority and affected individuals.
  3. Document everything: Keep records of the request, the provider's response, and the company's actions.

Strategic actions for transfers:

  1. Conduct a TIA for the US transfer: Evaluate US surveillance laws, the provider's ability to resist requests, and the sensitivity of the data. If the TIA concludes that adequate protection cannot be ensured, suspend the transfer or implement supplementary measures (e.g., end-to-end encryption where the provider has no access to keys, pseudonymization).
  2. Review the India transfer: Conduct a TIA for India as well, to ensure SCCs are effective. If gaps exist, implement additional safeguards.
  3. Renegotiate contracts: Update SCCs with the Indian subsidiary and the US provider to include obligations to challenge government requests, notify the EU company, and provide transparency reports. Ensure the US provider is contractually bound to resist unlawful access.
  4. Consider alternative solutions: If the US transfer cannot be made compliant, consider switching to a provider that stores data in the EU or implementing a hybrid solution where sensitive data remains in the EU.
  5. Notify customers and authority: If the transfer is unlawful or if the government request results in a breach, notify the supervisory authority within 72 hours and inform affected customers if there is a high risk. Even if not strictly required, transparency may be advisable.
  6. Engage with the supervisory authority: Proactively consult the supervisory authority about the transfer and the government request, demonstrating accountability.
  7. Update policies and training: Ensure staff are aware of transfer restrictions and the process for handling government requests.

Conclusion: The company should prioritize the US transfer, as it poses the highest risk. It must act swiftly to assess and mitigate, and be prepared to suspend the transfer if necessary.