Data Transfer Impact Assessments: Ensuring international transfers of data are legally compliant
Following on from our article on The New Standard Contractual Clauses, below we look at Data Transfer Impact Assessment considerations.
What is a Data Transfer Impact Assessment (DTIA) and when is it needed?
Simply put, the DTIA is an assessment process that needs to be carried out by those wanting to export data outside the European Economic Area (EEA) to what are known as third countries (see further below).
The need for a DTIA was confirmed with the recent release of the new EU Standard Contractual Clauses (the New EU SCCs) and must be carried out when exporting data from the EEA to countries that have not been recognised with an ‘adequacy decision’ by the European Commission (EC).
An ‘adequacy decision’ is essentially a recognition by the EC that the country in question has an adequate level of data protection laws to ensure that a data subject gains a similar level of protection to what s/he would receive under EU data protection laws. Where a country has not been so recognised, it is known as a ‘third country’ to which additional restrictions apply before data can be transferred there (see below).
The responsibility lies with the data exporter to assess the laws of the third country; they must also determine who the local data protection authority is in the third country, if any, and whether there are any form of laws, regulations and practices committed to data protection in place there. Not an easy task.