Data Transfer Risk Assessment

In this blog, our focus will be on transfer risk assessments (TRAs). We will begin by providing background information that led to the introduction of TRAs. Subsequently, we will address the following key questions:

1. What is a TRA?

2. Who does it apply to?

3. Why is it important?

4. How do you conduct a TRA?

5. What are the main challenges in conducting a TRA?

By addressing these questions, we aim to provide a comprehensive understanding of TRAs, their significance, and the practical considerations involved in conducting them.

Background

The July 2020 Schrems II judgement by the Court of Justice of the European Union (CJEU) had significant implications for the transfer of personal data to the United States, in accordance with GDPR principles. The CJEU ruled that the EU-U.S. Privacy Shield, which was previously considered an adequate mechanism for such transfers, is no longer valid.

However, the CJEU confirmed the validity of standard contractual clauses (SCCs) as a transfer mechanism, aligning with GDPR principles. Nevertheless, it emphasized the need to include supplementary clauses to ensure adequate protection of personal data, in line with GDPR principles. The decision also emphasized the importance of conducting a case-by-case assessment, as per GDPR principles, to determine if the personal data transferred will be sufficiently protected in the recipient country.

As a result, organizations involved in data transfers using SCCs or any other transfer mechanism are now required to perform a risk assessment, adhering to GDPR principles, before transferring personal data to a third country that lacks an adequacy decision from the EU. This assessment ensures that appropriate safeguards, as outlined by GDPR principles, are in place to protect the personal data being transferred.

By conducting these risk assessments, organizations can demonstrate their compliance with the Schrems II judgement and the GDPR's requirements, based on GDPR principles, for the lawful transfer of personal data outside the EU.

What is a TRA?

A transfer risk assessment (TRA) is an evaluation conducted by data exporters to assess the level of risk associated with international data transfers to third countries. The purpose of a TRA is to determine if the chosen transfer mechanism provides an adequate level of protection for the personal data being transferred.

During a TRA, several factors are taken into consideration. Firstly, the nature of the personal data being transferred is examined, including its sensitivity and the potential risks associated with its exposure or unauthorized access. Secondly, the destination country where the data will be transferred is assessed, considering its legal framework, privacy laws, and data protection practices.

By conducting a TRA, data exporters can identify potential risks and evaluate whether the chosen transfer mechanism, such as standard contractual clauses (SCCs) or binding corporate rules (BCRs), is suitable and provides sufficient safeguards for the specific transfer. This assessment ensures compliance with data protection regulations, such as the GDPR, and helps organizations make informed decisions regarding international data transfers.

Who Does it Apply to?

All data exporters based in the UK are required to conduct a risk assessment for all "restricted" data transfers. The UK Information Commissioner's Office (ICO) has provided guidance on defining restricted transfers as follows:

1. The personal data being transferred is subject to the UK General Data Protection Regulation (UK GDPR).

2. The data exporter is sending or making the data accessible to a data receiver or importer that is not subject to the UK GDPR.

3. The importer is a separate entity or individual, including companies within the same corporate group.

Restricted transfers are permitted under the UK GDPR if appropriate safeguards outlined in Article 46 are in place. To facilitate such transfers, the UK ICO released a revised set of standard contractual clauses (SCCs) in the form of a model international data transfer agreement (IDTA) in March 2022. These approved safeguards can be used for routine data transfers to third countries.

Recognizing that conducting a transfer risk assessment (TRA) can be a complex task for many data exporters, the UK ICO has recently published a helpful tool to assist with the assessment process. This tool aims to provide guidance and support in evaluating the risks associated with restricted data transfers and determining whether adequate safeguards are in place.

Why is the TRA Important?

Indeed, the TRA is crucial for UK-based data exporters to ensure that data protection rights are not circumvented when transferring personal data to third countries. While the model IDTA provides a binding agreement between the parties involved in a specific transfer arrangement, it may not cover all risks associated with third countries, nor does it regulate the actions of statutory agencies that may access the data.

Given that existing safeguards for third-country transfers cannot account for the legal regimes of all individual countries, it becomes necessary for data exporters, in collaboration with data importers, to conduct a case-by-case assessment of the protections available in the destination country. This assessment helps determine whether the IDTA alone provides sufficient safeguards for the restricted transfer or if additional measures and protections are necessary.

By conducting a TRA, data exporters can make informed decisions about the adequacy of the safeguards in place for each specific transfer and take appropriate steps to ensure the protection of personal data throughout the transfer process.

How Do You Conduct a TRA?

1. The specifics of the restricted transfer:

• Type and categories of personal data to be transferred.

• Types of entities involved in the transfer.

• Sector in which the transfer occurs.

• Technological and organizational security measures implemented by the data importer to protect the data.

• Whether the data will be stored outside the UK or if there is remote access to data stored within the UK.

• Movement of data while under the control of the data importer.

• Possibility of data being forwarded on by the data importer to another entity.

• Purpose of the transfer.

• Format of the data.

• Method of transfer.

1. The particular facts about the destination country:

• Partial UK adequacy regulations in relation to that country, if any.

• Human rights record of the destination country.

• Legal and court system of the destination country and its similarity to the UK legal and court system.

• Recognition and enforcement of overseas judgments in the destination country.

• Laws and practices governing third-party access, including public authority surveillance, in the destination country.

1. The potential impact on the data subjects of the transfer and any identified risks of harm to data subjects:

• Assessing the potential impact on data subjects and any risks associated with the transfer.

• Ensuring that the level of protection for data subjects does not decrease over time.

It is important to focus on the relevant aspects of the destination country's legal regime that directly relate to the restricted transfer. By evaluating these three areas, data exporters can determine whether the IDTA provides sufficient protection for data subjects, comparable to the protections they have when their data is in the UK.

1. THE SPECIFICS OF THE RESTRICTED TRANSFER, INCLUDING:

Correct, the TRA should assess the following aspects related to the specifics of the restricted transfer:

1. Type and categories of personal data to be transferred: Identify the nature of the personal data involved in the transfer, such as sensitive personal data or personally identifiable information.

2. Types of entities involved in the transfer: Determine the parties participating in the data transfer, including data exporters, data importers, and any other entities involved in the process.

3. Sector in which the transfer occurs: Consider the industry or sector in which the data transfer takes place, as different sectors may have specific data protection requirements or regulations.

4. The technological and organizational security the importer has in place to protect the data: Evaluate the measures and controls implemented by the data importer to ensure the security and protection of the transferred data, including encryption, access controls, and data breach response protocols.

5. Whether the data will be stored outside the UK or whether there is remote access to data stored within the UK: Determine if the data will be stored in a third country or if there will be remote access to data stored within the UK, as this may impact the level of protection and compliance with UK data protection laws.

6. Movement of data when under the control of the importer: Assess how the data will be handled and processed by the data importer, including any data transfers or sharing with other entities.

7. Possibility of data being forwarded on by the importer to another entity: Consider whether the data importer has the ability to forward or share the data with other entities, and if so, evaluate the implications for data protection and security.

8. Purpose of the transfer: Determine the purpose for which the data is being transferred, such as for the provision of a service, contractual obligations, or legal requirements.

9. Format of data: Identify the format or structure of the data being transferred, whether it is structured data, unstructured data, or in a specific file format.

10. Method of transfer: Evaluate the means or mechanisms used to transfer the data, such as electronic transmission, physical storage devices, or cloud-based services.

By assessing these aspects, data exporters can gain a comprehensive understanding of the specific details surrounding the restricted transfer and determine the adequacy of protection provided to the data subjects involved.

2. THE PARTICULAR FACTS ABOUT THE DESTINATION COUNTRY, INCLUDING:

Absolutely, the TRA should also consider the particular facts about the destination country, including:

1. Whether there are partial UK adequacy regulations in relation to that country: Determine if there are any specific regulations or agreements in place between the UK and the destination country that address the adequacy of data protection standards.

2. Its human rights record: Assess the human rights situation in the destination country, including factors such as privacy rights, freedom of expression, and protection against unlawful surveillance.

3. Its legal and court system, and how close it is to the UK legal and court system: Evaluate the legal framework and judicial system of the destination country, including the level of independence and effectiveness of the courts in upholding data protection and privacy rights. Consider any similarities or differences between the legal systems of the UK and the destination country.

4. How overseas judgments are recognized and enforced: Determine how judgments or decisions related to data protection and privacy issues from the UK would be recognized and enforced in the destination country, and vice versa.

5. Its laws and practices regulating third-party access (including public authority surveillance): Examine the laws, regulations, and practices in the destination country related to third-party access to personal data, including government surveillance activities and the protection of individuals' privacy rights.

By considering these factors, data exporters can assess the level of protection and safeguards provided by the destination country's legal framework and practices, and determine if it aligns with the level of protection that data subjects would have when their data is in the UK. This assessment helps ensure that the transfer of personal data to the destination country is compliant with data protection requirements and minimizes the risk of inadequate protection for data subjects.

3. THE POTENTIAL IMPACT ON THE DATA SUBJECTS OF THE TRANSFER, AND ANY RISK OF HARM TO DATA SUBJECTS WHICH MAY BE IDENTIFIED.

You're correct. It is crucial to ensure that the level of protection for personal data does not decrease over time. Data importers should be aware of potential factors that may undermine the level of protection, including:

1. Changes to the processing by the importer: Any changes in how the data importer handles or processes the personal data can impact the level of protection. It's important to assess whether these changes introduce new risks or affect the safeguards in place.

2. Changes to the legal framework in the destination country: If there are changes to the data protection laws or regulations in the destination country, it's necessary to evaluate how these changes may impact the protection of personal data and whether they align with the safeguards provided by the IDTA or other transfer mechanisms.

3. Technical developments facilitating the bypassing of security arrangements: Advancements in technology can introduce new risks and vulnerabilities. It's important to stay updated on technological developments that could potentially undermine the security arrangements and safeguards in place for the transferred data.

When conducting the TRA, it is advisable to focus on those aspects of the destination country's legal regime that are relevant to the restricted transfer. This allows for a more targeted and efficient assessment of the risks and protections associated with the transfer.

Lastly, it's important to note that while the ICO provides a TRA tool as a helpful resource, its use is not mandatory. The key objective is to ensure that a comprehensive risk assessment is conducted to evaluate the adequacy of data protection measures and safeguards for the restricted transfer.

What are the Main Challenges in Conducting a TRA?

You're correct in pointing out that conducting a TRA can be a challenging task, especially when transferring personal data to jurisdictions with different legal frameworks, particularly in relation to national security laws and law enforcement regimes. This challenge is faced by data exporters worldwide, not just in the UK.

The transparency and clarity of national security laws and law enforcement regimes vary across jurisdictions, and some may have deliberately opaque or secret laws in place. This can make it difficult for data exporters to assess the level of protection and risks associated with data transfers to such jurisdictions.

The efforts made by the ICO in providing resources like the IDTA and TRA tool aim to assist data exporters in navigating these challenges and conducting thorough risk assessments. However, it's important to recognize that the complexity and burden of conducting a TRA can vary depending on the scale and nature of data transfers.

For large organizations with numerous data transfers to multiple third-country destinations, conducting TRAs for each transfer can indeed be a demanding task. It may require dedicated resources and expertise to ensure compliance and adequate protection for each transfer.

Small data exporters may also face challenges in terms of resource limitations and the need to understand the intricacies of international data transfers and relevant legal frameworks.

In any case, it's crucial for data exporters to prioritize the protection of personal data and ensure compliance with applicable data protection laws and regulations. This may involve seeking legal advice, leveraging available tools and resources, and adopting a risk-based approach to focus efforts on transfers that present higher risks to individuals' data protection rights.

While conducting TRAs can be burdensome, it is an essential step to ensure the lawful and secure transfer of personal data to third countries, safeguarding the privacy and rights of data subjects.

URM believes that UK data exporters face 3 principal challenges:

You've highlighted some valid challenges that data exporters, particularly small to medium-sized ones, may face when conducting TRAs and ensuring the required levels of data protection in destination countries. Here are some considerations and potential solutions:

1. Lack of internal knowledge: Many data exporters may not have in-house expertise on the legal regimes of destination countries. In such cases, seeking external legal advice or consulting with GDPR consultants and experts in international data protection law can be beneficial. Engaging legal professionals who specialize in data protection and international transfers, such as GDPR consultants, can help navigate complex legal frameworks and ensure compliance.

2. Opacity of destination country laws: Opaque or complex legal systems in destination countries can make it challenging to determine the level of data protection afforded. It's important to conduct thorough research and engage legal experts, including GDPR consultants, who have experience with the specific jurisdiction. Collaborating with local partners or legal representatives in the destination country can provide insights into local laws and practices, further supported by GDPR principles.

3. Monitoring changes in legal regimes: Data protection laws and regulations in destination countries may evolve over time, requiring ongoing monitoring and assessment. Establishing a collaborative relationship with the data importer is crucial in this regard. Regular communication and information sharing with the importer can help stay informed about any changes in the legal framework or data handling practices. Additionally, data exporters can explore contractual obligations or agreements with importers to ensure they are kept updated on relevant changes, with the guidance of GDPR consultants.

4. Monitoring data handling by the importer: Data exporters should have mechanisms in place to monitor the data handling practices of the importer. This can be achieved through contractual provisions, periodic audits, or certifications that require importers to maintain adequate security measures and comply with data protection obligations, in accordance with GDPR principles. Regular communication and transparency with the importer can help identify any changes or potential risks in data handling, with the assistance of GDPR consultants.

Collaboration and open communication between data exporters and importers are essential to address these challenges effectively. Establishing strong relationships, sharing knowledge and responsibilities, and maintaining ongoing dialogue can help ensure that data transfers are conducted in a manner that upholds the required levels of data protection and compliance with relevant regulations, with the guidance of GDPR consultants.