How to share international data correctly?

Transfer data from one country to another legally

The exploitation of personal data that companies make of their clients or potential clients is another task in every company.

Specifically, the proper use of data makes great sense in the company's marketing efforts.

It is no longer enough to simply sell, develop a marketing plan , or establish strategic alliances.

Data collection and analysis allows companies to analyze their customers' psychological profiles, tastes, habits, and behaviors, and to predict future actions.

This information has a very high value for companies: it is oil. 

The fact: the oil of the 21st century

There is an undeniable hunger among many companies for data about their customers and potential customers.

Even so, the governments of some countries, regulatory bodies and even international organizations aim to ensure that the processing of this data by its controller ( natural or legal person, public authority, service or other body which, alone or together with others, determines the purposes and means of the processing ) is done in a transparent manner and does not seriously harm the interests of their citizens.

In Europe, the main standard-bearer of this fight is the EU.

Among other issues, the Union is focusing its attention on what are known as Cross-border data transfers.

Whether you are an entrepreneur or self-employed person in Spain, you must take into account the following data protection legislation: 

• Regulation EU 2016/679 of the European Parliament and of the Council, of April 27, 2016, relating to the protection of natural persons regarding the processing of personal data and the free circulation of such data, which repeals Directive 95/46/EC. 
• Organic Law 3/2018, of December 5, protection of personal data and guarantee of digital rights. 
• Instruction 1/2006, of November 8, of the Spanish Data Protection Agency, on the processing of personal data for video surveillance purposes, through camera or video camera systems. 

At RRYP Global we are aware that it is not easy to comply with these obligations in all the international markets where a company operates.

For this reason, we want to accompany and advise you so that your business complies with the relevant legislation. 

How does data protection and its transnational transfers affect users? ecommerces?

The online transactions we make throughout the day sometimes exceed those we make in person.

When we carry them out, we are providing the selling company with a lot of our personal information, such as our bank details, place of residence…

These ecommerce businesses are companies, so they are also required to comply with European regulations on data protection and transnational data transfers.

Therefore, they must comply with their own obligations if the data is shared with a country outside the EEA.

They often use this data to offer customers products that might interest them based on their searches and purchases.

This is why it is so important for e-commerce to manage data in the most cost-effective way possible. 

What are cross-border data transfers?

They are a flow of personal data of natural persons that travels from a country in the EEA (European Economic Area, whose members are the EU, Iceland, Liechtenstein and Norway) to another State outside this Area.

Therefore, A transnational data transfer can occur in three situations:
– 1) One controller is established in the EEA and the other controller is established outside the Area or is part of an international organization. 
– 2) A controller is established in the EEA and the processor is outside the EEA. 
– 3) One processor is established in the EEA and the other processor is established outside the EEA. 

In all three cases, the data travel outside the EEA, but they differ in the person involved and in the functions that each one has.

The data controller is the natural or legal person, public authority, agency or other body which , alone or jointly with others, determines the purposes and means of the processing.

On the other hand, the data processor is the natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller.

How to correctly transfer data outside the EEA?

The GDPR establishes restrictions on the transfer of personal data outside the European Economic Area (EEA), with the aim of ensuring that the level of protection afforded to individuals remains equivalent to that provided by this regulation.

Transfers of personal data to countries outside the EEA or international organizations can only be carried out in compliance with the conditions set out in Chapter V of the GDPR.

In addition to these specific conditions, any transfer must comply with the rest of the general provisions of the GDPR.

This means, for example, respecting the fundamental principles of data processing, ensuring an adequate legal basis, applying appropriate security measures and ensuring that only strictly necessary data is transferred (minimisation principle). If the recipient of the personal data acts as a data processor, a contract is required, just as would be the case with a data processor within the EEA.

The GDPR provides two main ways to transfer personal data to countries outside the EEA or to international organizations.

One is through an adequacy decision , in which the European Commission recognizes that the recipient country offers an adequate level of protection.

Failing that, the transfer must be based on adequate guarantees , such as legal mechanisms that ensure the protection of the rights of the interested parties.

If there is no adequacy decision or adequate safeguards, the GDPR allows certain exceptions in specific situations.

Adequacy decision

The European Commission can decide whether a country outside the European Economic Area (EEA) or an international organization has a level of data protection similar to that of the EU.

If it so determines, it issues an "adequacy decision," which facilitates the transfer of data to that country without the need for additional requirements.

To make this decision, the Commission analyzes several aspects , such as respect for the law, the protection of human rights, whether citizens can assert their rights, whether there is an independent data protection authority and whether the country has signed international agreements on privacy.

If a country receives an adequacy decision, companies within the EEA can send personal data to organizations in that country without having to implement additional security measures.

This means that the transfer of data will be handled in a similar way as it would be within the EEA. However, the company transferring the data still has the responsibility to comply with the general rules of the GDPR.

These decisions may apply to an entire country or just a specific region, and may cover all data transfers or just some depending on the type of sector or activity.

Countries with adequacy decision

So far, the European Commission has adopted adequacy decisions for:

• Andorra,
• Argentina,
• Canada (trade organizations),
• Faroe Islands,
• Guernsey,
• Israel,
• Isle of Man,
• Japan,
• Jersey,
• New Zealand,
• Republic of Korea,
• Switzerland,
• United Kingdom,
• United States (commercial organizations participating in the EU-US Data Privacy Framework),
• Uruguay.

Adequate guarantees

If there is no adequacy decision , organizations can still transfer personal data to other countries if they guarantee that the receiving entity will adequately protect the information.

In addition, people must be able to assert their rights and have effective legal mechanisms in case of problems.

Article 46 of the GDPR sets out several options that companies can use to securely transfer data outside the EEA.

Key tools available to private organizations include:

• Standard Contractual Clauses (SCC): Standard agreements approved by the European Commission that guarantee data protection.
• Binding Corporate Rules (BCR): Internal rules applied within large companies or multinational groups to protect personal data.
• Codes of conduct: Standards agreed upon by a specific sector to comply with the GDPR.
• Certification mechanisms: Verification systems that confirm that an organization complies with data protection standards.
• Customized contractual clauses: Specific agreements between companies that include appropriate data protection measures.

These tools allow data transfers to be carried out securely and in compliance with regulations.

Exceptions

In addition to adequacy decisions and the tools of Article 46 of the GDPR , there is a third option for transferring personal data in specific circumstances.

Under certain conditions, it is possible to carry out transfers based on one of the exceptions set out in Article 49 of the GDPR.

They cannot be used as a matter of course to justify transfers of data outside the EEA.

The general rule remains that data may only be transferred if the receiving country guarantees an adequate level of protection or if appropriate safeguards have been put in place.

According to Article 49 of the GDPR, a transfer or set of transfers may be made if they meet one of the following conditions:

• Explicit consent: The affected person has given clear and informed authorization for the transfer.
• Execution of a contract: The transfer is necessary to perform a contract between the individual and the organization or to take pre-contractual steps at the individual's request.
• Contractual interest of a third party: The transfer is required to execute a contract for the benefit of the individual between the controller and another party.
• Public interest: It is necessary for important reasons of public interest.
• Legal claims: The transfer is essential to establish, exercise or defend legal claims.
• Protection of vital interests: It is necessary to protect the life or safety of the person or others, especially if the person is unable to give consent due to physical or legal incapacity.
• Public information: The transfer originates from a public register which, according to national or EU law, is intended to be consulted by the general public or by persons with a legitimate interest in accessing it.

Example of a penalty for non-compliance

However, in 2021 Amazon was ordered to pay 746 million euros by the Luxembourg National Data Protection Commission (CNPD) for failing to comply with EU data protection legislation.

They were accused of using customer and partner data to falsify competition and thus unfairly gain a greater advantage in the market.

The company appealed the fine before the Luxembourg Administrative Court.

Therefore, if you own an e-commerce business, you must take great care of your company's practices in this area.

Conclusion on transferring data from one country to another legally

Every company or self-employed person carrying out a professional or business activity in the EU must comply with European data protection regulations.

If you have an international business, you should pay special attention to cross-border transfers of personal data, as failure to comply with the law can result in severe penalties for your business. 

Online businesses must pay special attention to this regulation due to the large amount of sensitive data they store about their customers.

FAQ

RRYP Global , lawyers specializing in international law.