Understanding Privacy Regulatory Restrictions on Trans Border Data Flow

Transcription

1 Understanding Privacy Regulatory Restrictions on Trans Border Data Flow Peter J Reid, CIPP EDS Chief Privacy Officer Office: Mobile: peter.j.reid@eds.com / / / 1 / Aug / EDS, 2008

2 Agenda 1. Privacy 2. Options to address TBDF restrictions 3. U.S. DoC Safe Harbor Program 4. Model Contracts 5. Binding Corporate Rules / / / 2 / Aug / EDS, 2008

3 Privacy Restrictions On Trans-Border Data Flow Privacy & Data Protection regulations restrict transfer of personal information across national borders Transfers from all countries with national legislation are restricted EU/EEA, Argentina, Australia, Canada, HK, NZ, etc. From EU/EEA countries, personal information can be transferred to countries that have adequate protection All other EU/EEA member states Switzerland, Canada & Argentina (all have regulations deemed adequate by EU) No other major countries have privacy regulations that have been deemed adequate **Note that access to personal information stored in another country constitutes a transfer (e.g. Help Desk, support team in India having access to data in EMEA is considered a transfer & is restricted) / / / 3 / Aug / EDS, 2008

4 Overcoming Privacy Restrictions Mechanisms to overcome transfer restrictions a. Information can be transferred from an EU/EEA country to U.S. if receiving entity has joined U.S. DoC Safe Harbor b. Personal information can also be transferred from any EU/EEA country to any non-eu/eea country, other than Canada and Argentina, if: i. A model contract has been signed & in many instances approved by the country regulator ii. Binding Corporate Rules have been approved iii. The individual has freely given consent c. Transfers from other countries with national privacy legislation (e.g. Canada, Argentina) also require contractual agreement that appropriate protection will be provided in the receiving country / / / 4 / Aug / EDS, 2008

5 U.S. DoC Safe Harbor Program EC and DoC agreed in 1999 to implement a Safe Harbor Program Allows members to transfer PI from EU countries to the US Also allows onward transfers FTC is nominated regulator Is not available for Financial Services Companies / / / 5 / Aug / EDS, 2008

6 EU Model Contracts What is a Model Contract? Contractual agreement defined and adopted by the EU Article 29 Working Party and approved by the European Commission Objective is to meet the adequacy standards under the E.U. Data Protection Directive for transfers of personal data outside of the E.U. Contains data protection commitments, company liability requirements and liabilities to the individuals concerned Known as Model Contracts or Model Clauses or Standard Clauses / / / 6 / Aug / EDS, 2008

7 Key Terminology Data Controller An entity (whether a natural or legal person, public authority, agency or other body) which alone, jointly or in common with others determines the purposes for which and the manner in which any item of Personal Data is processed. Data Processor An entity (whether a natural or legal person, public authority, agency or any other body) which processes personal data on behalf and upon instructions of the Data Controller. Data Subject An identified or identifiable individual to whom Personal Data relates, whether such identification is direct or indirect (for example, by reference to an identification number or to one or more factors specific to physical, physiological, mental, economic, cultural or social identity). Data Exporter and Data Importer Data Protection Authority (DPA) / / / 7 / Aug / EDS, 2008

8 Considerations for use of Model Clauses Ensure correct type of Model Contract is used Two types of model clauses Controller to Controller Controller to Processor Contain obligations on both the data exporter and data importer As it relates to Outsourcing Outsourcer is the Data Controller and Data Exporter Service provider is the Data Processor and Data Importer (in most cases) Key Point to consider Not all Outsourcing Service providers understand the EU data transfer requirements / / / 8 / Aug / EDS, 2008

9 Other Considerations for Model Clauses Can be a lengthy process Each data exporter and data importer may need to sign a contract Example: company has entities in Belgium and Germany and transfers personal information to entities in India and China - results in minimum 4 contracts Some EU Data Protection Authorities require preapproval of contracts which can take 2 to 6 months Pre-approval required in following countries: Austria, Cyprus, Denmark, Estonia, France, Greece, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Romania, Slovakia, Slovenia and Spain Notification required in Belgium and Portugal / / / 9 / Aug / EDS, 2008

10 EU Model Contracts - Pros and Cons Pros Must be accepted by EU regulators as providing adequate protection for transfers out of the EU Cons Each contract relates only to an individual combination of exporter and importer Pre-approval process for contracts by some authorities can be very lengthy Each contract relates to specific purposes. If the purposes substantially change then further contracts are required and the process requires repeating In rare circumstances the data importer may become liable for damages Often requires use of Outside Counsel / / / 10 / Aug / EDS, 2008

11 EU Binding Corporate Rules What are Binding Corporate Rules? A mechanism, adopted by the Article 29 Working Party, by which a corporate group may demonstrate adequate protection for transfers of personal information between EU and non-eu members of the group in compliance with the EU Data Protection Directive Requirement: Binding internal agreement/contract that obligates all legal entities within a corporate group that will have access to E.U personal information to adhere to all obligations of the EU Data Protection Directive Evidence of supporting measures to ensure compliance Objective is to meet the adequacy standards under the E.U. Data Protection Directive for transfers of personal data outside of the E.U. Alternative to Model Contracts and DoC Safe Harbor membership / / / 11 / Aug / EDS, 2008

12 New BCR Guidance Documents Three New Documents - Adopted 24 June 2008, published in July WP153 - Table with the elements and principles to be found in Binding Corporate Rules Summarises key points of previous guidance documents WP74 and WP108 Adds clarification and more detail Advice on content inclusion in BCR and/or application Some DPAs using as checklist immediately even for submissions that were written without the benefit of this added information / / / 12 / Aug / EDS, 2008

13 New BCR Guidance Documents (cont) WP154 - Setting up a framework for the structure of Binding Corporate Rules Recommended structure for a BCR WP155 - Frequently Asked Questions (FAQs) related to Binding Corporate Rules / / / 13 / Aug / EDS, 2008

14 Binding Corporate Rules Pros & Cons Pros One agreement covers all company entities globally Broad range of high-level purposes may be specified Liability for claims from employees remains with an EU nominated company Once approval granted then no further pre-approval required Potential to extend to customer data Cons Approval process can take two years but is a one-off approval Some EU countries currently cannot approve due to local law restraints Some basic rights have to be extended to non-eu employees / / / 14 / Aug / EDS, 2008

15 Other Considerations Employment laws in many EU countries also require establishment of Works Councils In many instances the Works Councils must be notified when any personal information is being moved outside the source country In extreme cases (e.g. Germany) they can significantly delay, even prevent, transfers from occurring / / / 15 / Aug / EDS, 2008

16 It s a matter of trust Peter J Reid EDS Chief Privacy Officer 5400 Legacy Drive Plano, TX Office: Mobile: peter.j.reid@eds.com / / / 16 / Aug / EDS, 2008 EDS and the EDS logo are registered trademarks of Electronic Data Systems Corporation. EDS is an equal opportunity employer and values the diversity of its people Electronic Data Systems Corporation. All rights reserved.