What is a Data Transfer Impact Assessment ("DTIA")?

Introduction

The Data Transfer Impact Assessment ("DTIA") is a relative newcomer to the field of privacy and data protection law. The emergence of the DTIA is one of the sometimes under-reported consequences of the notorious Schrems II ruling of the Court of Justice of the EU on the transfer of personal data outside the EU.

What is a Data Transfer Impact Assessment ("DTIA") and how do you know when one ought to be conducted?

What is the background to the Data Transfer Impact Assessment?

The EU Standard Contractual Clauses ('SCCs') are one of the means under the General Data Protection Regulation (GDPR) to lawfully transfer personal data to entities located outside the EU/European Economic Area. The Dutch term for SCCs is ‘modelcontractbepalingen’. The GDPR's name for exporting personal data outside the EU/EEA is transfer to a third country.

The SCCs aim to provide the same level of protection for the fundamental rights of individuals whose personal data is transferred outside the EU/EEA as that provided by the EU General Data Protection Regulation (GDPR) and related laws and regulations. Such a level of protection is achieved by means of appropriate safeguards, enforceable rights and effective legal remedies for the data subject.

However, there is a problem with the use of SCCs to achieve adequate safeguards, enforceable rights and effective remedies for data subjects outside the EU/EEA. Due to their contractual nature, SCCs are not binding on the local authorities of a third country, as those local authorities are not party to the agreement incorporating the SCCs. Risks that may arise as a result of this reality include:

• the risk that the laws or practices of the third country may prevent either party from complying with the contents of the SCCs;
• the risk that local authorities (il)legitimately demand disclosure of or access to personal data;
• The risk that local laws and practices prevent the return or destruction of personal data.

The DTIA is part of the fulfilment of the responsibilities of a party that wishes to export personal data outside the EU/European Economic Area. Performing a DTIA in advance serves to map out the risks that play or may play a role in a planned transfer of personal data to a third country. 

To whom does the obligation to carry out a Data Transfer Impact Assessment apply?

The controller and/or processor within the meaning of the GDPR are obliged to examine the risk to the level of protection for the rights of data subjects when transferring their personal data to a third country. If the risk to the rights of data subjects is unacceptably high, additional measures must be taken in addition to the SCCs that have been established.

If it is not possible to take sufficient additional measures to restore the required level of protection, the controller and/or processor shall be ultimately obliged to suspend or terminate the transfer of personal data to the third country. The national data protection authority may also order the suspension or termination of the transfer of personal data on grounds of incompatibility between the laws and practices of the SCC and the locally applicable laws and practices.

When concluding standard contractual clauses, the Parties are obligated to ensure that they have no reason to believe that the laws and practices of the third country prevent the data importer from fulfilling its obligations under the SCCs.

What topics should be assessed in a Data Transfer Impact Assessment?

When providing the guarantees required under SCCs to protect the rights of data subjects in case of transfer of their personal data to a third country, the Parties declare to have taken into account the following elements:

• The specific circumstances of the transfer
• The legislation and practices of the third country
• any relevant contractual, technical or organisational safeguards that complement the guarantee under the SCCs

SCCs require the Parties to document the assessment. The DTIA can serve as this documentation.

In addition, an element of the assessment shall be the relevant and documented practical experience of past cases of disclosure requests by local authorities, in particular internal records or other documentation continuously compiled in accordance with due diligence and certified at senior management level. Provided that the practical experience can be corroborated by other relevant objective elements, is appropriately weighted in terms of representativeness and does not contradict publicly available information on the application of foreign law in practice within the same sector in case law and reports of independent oversight bodies.

What are the consequences if a Data Transfer Impact Assessment is not carried out?

Fines and liability

If a DTIA is not performed when it should have been, the data exporter and the data importer risk having fines imposed on them by the national supervisory authority, in the Netherlands the 'Autoriteit Persoonsgegevens'. Data subjects can also hold parties liable under the GDPR on their own initiative if they have suffered material or immaterial damage as a result of a transfer to a third country in which their rights were inadequately safeguarded. In short, it is very wise to check whether a DTIA is necessary before proceeding with a transfer of personal data outside the EU and to actually implement and document it.

What is the difference between a Data Transfer Impact Assessment ("DTIA") and a Data Protection Impact Assessment ("DPIA")?

The Data Protection Impact Assessment ("DPIA") is by now a familiar concept to many companies and organisations. It is important not to confuse these two types of risk assessment. The DPIA and the DTIA cover different risks and scenarios, although obviously both could be carried out simultaneously or in combination. A Data Protection Impact Assessment is mandatory when there is likely to be a high risk to the privacy of data subjects, including in the case of large-scale, systematic and systematic processing of personal data. Even when a Data Protection Impact Assessment is not legally required under the GDPR, it may be wise to have one carried out before commencing with the large-scale processing of (particularly or sensitive) personal data.

Conclusion

The Data Transfer Impact Assessment may be required when your organisation intends to transfer personal data to an entity in a third country outside the EU based on standard contractual clauses, for which the European Commission has not issued an adequacy decision. For transfers of personal data to third countries outside the EU, it is important that the same level of protection as under the GDPR is maintained through appropriate safeguards, enforceable rights and effective legal remedies for the data subjects. Due to the contractual nature of the standard contractual clauses, there are various risks that the local authorities and legislation of the third country will undermine the protection offered by the SCCs. When using the SCCs, the parties give an assurance that they have assessed and documented whether there is a risk that they will not be able to meet the contractual safeguards contained in the SCCs. The DTIA is the name for this risk assessment by the parties and, if done properly, can serve as the required documentation.

In order to avoid fines or liability claims when your organisation intends to transfer personal data to a third country outside the EU/EEA, it is wise to check whether you need to perform a DTIA.

Do you need a Data Transfer Impact Assessment? Do you have sufficient insight into the data flows of personal data from and to your organisation? Does your organisation export personal data outside the European Economic Area or are there plans to do so?

Advice!

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!