Global HR Data Transfers, a New Owner, and a Works Council Request
Alpine Biotech AG, headquartered in Basel, runs clinical-trial operations for 12,000 participants across the EU, UK, and Brazil. Its global HR platform is hosted by a US provider, and the parent company in Boston runs global performance reviews using data on 2,600 EU employees. The transfer relies on the 2021 SCCs; no transfer impact assessment has been documented since 2022, when the provider was acquired by a private-equity firm. The provider receives government requests, has a policy of challenging them but not always notifying Alpine, and stores backups in three US regions. The UK entity uses a separate UK addendum but the EU entity's data is included in global reports. Brazilian counsel says LGPD requires a named encarregado and a documented transfer mechanism, and neither is in place. A works council request asks for a copy of the TIA and the list of sub-processors. Legal says 'SCCs are signed, so we are compliant'.
1. Evaluate whether the SCCs alone are sufficient and what the transfer impact assessment must cover.
Read the worked answer
SCCs are a mechanism, not a conclusion. Art 44 requires that the transfer not undermine the level of protection. After Schrems II, the exporter must do a TIA: map the data, sensitivity, purposes, recipient, sub-processors, and the legal regime (for example FISA 702, EO 12333, and the CLOUD Act), the provider's request history and challenge policy, and the likelihood of access. The 2022 acquisition and the three US backup regions are material changes that require a refreshed TIA; the 2021 SCCs may still be valid, but the assessment is missing.
Government requests: a policy of challenging but not always notifying is relevant to effectiveness, especially if the controller cannot detect access. The TIA must test the specific support model, not generic claims. It should also cover the UK addendum and the EU data included in global reports.
Conclusion: 'signed SCCs' is not a compliance answer. If the TIA shows no effective remedy, the transfer must be suspended or restructured; derogations are for occasional, non-repetitive transfers. The works council request should be answered with a redacted TIA, not a refusal based on the contract alone.
2. Recommend supplementary measures and assess their limits in this specific support model.
Read the worked answer
Supplementary measures: strong encryption with keys held outside the provider's control; pseudonymization; EU-based support and access controls; split processing so identifiable data stays in the EU; contractual notification of requests, challenge obligations, and transparency reports; audit rights.
Limits: encryption at rest is weak if the provider holds keys or needs plaintext for support; contractual measures do not bind governments; pseudonymized data can be re-identified; localization may conflict with global HR needs. Technical measures are stronger than contractual ones, but the controller must test whether they actually prevent access in the specific support model. If the provider's support staff can view EU employee records, encryption at rest does not prevent access.
Assessment: combine technical and organizational measures, document the residual risk, and consider whether global performance reviews need identifiable EU data at all; aggregate or anonymize where possible. The controller should also verify that the UK addendum and the EU SCCs are not mixed in a way that leaves gaps. If residual risk remains high, the transfer should not proceed on the current architecture. The TIA should record the reasoning, not just the conclusion.
3. Advise on the Brazilian encarregado and transfer mechanism and on the works council request, and identify who owns the decision.
Read the worked answer
Brazil: LGPD requires a named encarregado and a documented international transfer mechanism. If trial data is transferred out of Brazil, identify the applicable mechanism (adequacy, contractual clauses, binding corporate rules, consent, or another legal basis) and publish the encarregado. Do not assume the EU SCCs cover Brazil; the legal bases and transfer tools are separate. Brazilian counsel should confirm the registration and publication steps.
Works council: the TIA and sub-processor list should be shared in redacted form; commercial terms and security details can be protected, but the council's information and consultation rights under national law must be respected. A blanket refusal is likely to escalate the dispute and may breach national labour law.
Ownership: the controller (Alpine AG, with the Boston parent for its own purposes) decides whether to suspend or restructure; the DPO advises and monitors; the processor cannot decide. The board should receive a decision memo with the TIA conclusion, the works council response, and the Brazilian remediation. If the TIA shows high residual risk, the board must decide explicitly and record the accepted risk.