Submission to the European Data Protection Board on the regulation of international data transfers under the GDPR

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

Submission to the European Data Protection Board on the regulation of international data transfers under the GDPR

Varun Sen Bahl

@varunsenbahl1

February 8, 2022

Public Policy

269

We recently submitted our feedback to the European Data Protection Board (EDPB) on their draft guidelines published on specific issues about the treatment of international data transfers (available here) under the General Data Protection Regulation (GDPR).

These draft guidelines aim to clarify the interplay between the rules on the use of transfer tools (under chapter V of the GDPR) and the rules on how the GDPR applies extraterritorially, that is, to entities situated outside the EU. A notable aspect of these draft guidelines was the effort to define the concept of a “transfer”, a key concept in the GDPR that is not given a formal legal definition in the regulation.

In our feedback, we focused on asking the EDPB to nuance their understanding of a “transfer” and to not require transfer tools where there is a low risk of personal data not being appropriately protected.

First, we noted that the definition of a transfer rests on two key phrases – “disclosure by transmission” and “making available” of personal data. Neither of these are defined. We submitted that this a missed opportunity to examine how this legal concept can be properly delimited.

Second, we noted that the EDPB has, across documents, assumed that scenarios of “remote access” of personal data will always be regarded as a transfer, even though what is meant by this term is not clarified. We submitted that the EDPB should look to define what it means by “remote access” and to exclude scenarios that should not need a transfer tool. For instance, a transfer tool should not be required for operations where the personal data does not actually move to a territory outside the EU and is only viewed by a non-EU data processor who cannot export or download such personal data.

Third, we also noted that the concept of “transfer” should not be interpreted in a manner where it also applies to personal data that moves between different jurisdictions when in transit from one organization to another. So, for instance, if an EU data controller sends personal data to an EU data processor, but that personal data passes through a server in a territory outside the EU in transit, then this should not be regarded as a transfer if the personal data is not accessed or manipulated whilst in transit.

A copy of our submission is enclosed. For any questions or clarifications, please write to varun@nasscom.in.

#Policy #datatransfer #dataprotection #EPDB #internationaldatatransfer #GDPR

Disclaimer

That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.

Download Attachment

Varun Sen Bahl

Manager - Public Policy

Reach out to me for all things about data regulation, cybersecurity policy, and internet governance.