Therefore, although there are situations in which, depending on the law and practices in force in the third country concerned, the recipient of such a transfer is in a position to guarantee the necessary protection of the data solely on the basis of a standard data protection clauses, there are others in which the content of those standard clauses might not constitute a sufficient means of ensuring, in practice, the effective protection of personal data transferred to the third country concerned. That is the case, in particular, where the law of that third country allows its public authorities to interfere with the rights of the data subjects to which the data relates.

Thus, the question arises whether a Commission decision concerning standard data protection clauses, adopted pursuant to Article 46(2)(c) of the GDPR, is invalid in the absence, in that decision, of guarantees which can be enforced against the public authorities of the third countries to which personal data is or could be transferred pursuant to those clauses.

Article 46(1) of the GDPR provides that, in the absence of an adequacy decision, a controller or processor may transfer personal data to a third country only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. According to Article 46(2)(c) of the GDPR, those safeguards may be provided by standard data protection clauses drawn up by the Commission. However, those provisions do not state that all safeguards must necessarily be provided for in a Commission decision such as the SCC Decision.

The assessment may reveal that relevant legislation in the third country may be problematic[^50] and that the transferred data and/or the importer at hand fall or might fall within the scope of this problematic legislation.[^51]

In light of uncertainties surrounding the potential application of problematic legislation to your transfer, you may then decide to:

• Suspend the transfer;

• Implement supplementary measures[^52] to prevent the risk of potential application to your importer and/or to your transferred data of laws and/or practices of the third country of (Page 17-18)

This quote suggests that if an assessment reveals problematic legislation in the third country that may impinge on SCCs' ability to provide essentially equivalent protection, the data exporter should consider suspending the transfer or implementing supplementary measures.

Alternatively, you may decide to proceed with the transfer without being required to implement supplementary measures, if you consider that you have no reason to believe that relevant and problematic legislation will be applied, in practice, to your transferred data and/or importer. You will need to have demonstrated and documented through your assessment, where appropriate in collaboration with the importer, that the law is not interpreted and/or applied in practice so as to cover your transferred data and importer, also taking into account the experience of other actors operating within the same sector and/or related to similar transferred personal data and the additional sources of information described further below.[^53]

You should conduct this overall assessment of the law and practice of the third country of your importer applicable to your transfer with due diligence and document it thoroughly. Your competent supervisory and/or judicial authorities may request it and hold you accountable for any decision you take on that basis.[^58]

By its request for a preliminary ruling, the referring court asked the Court whether the GDPR applies to transfers of personal data pursuant to the standard data protection clauses in Decision 2010/87, what level of protection is required by the GDPR in connection with such a transfer and what obligations are incumbent on supervisory authorities in those circumstances. The High Court also raised the question of the validity both of Decision 2010/87 and of Decision 2016/1250.

The Court found that Decision 2010/87 establishes such mechanisms. In that regard, the Court pointed out, in particular, that that decision imposes an obligation on a data exporter and the recipient of the data to verify, prior to any transfer, whether that level of protection is respected in the third country concerned and that the decision requires the recipient to inform the data exporter of any inability to comply with the standard data protection clauses, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the former

In the view of the Court, the limitations on the protection of personal data arising from the domestic law of the United States on the access and use by US public authorities of such data transferred from the European Union to that third country, which the Commission assessed in Decision 2016/1250, are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law, by the principle of proportionality, in so far as the surveillance programmes based on those provisions are not limited to what is strictly necessary. On the basis of the findings made in that decision, the Court pointed out that, in respect of certain surveillance programmes, those provisions do not indicate any limitations on the power they confer to implement those programmes, or the existence of guarantees for potentially targeted non-US persons.

In addition, according to Article 49, personal data can be transferred to a third country or an international organisation without the existence of an adequate level of protection or the implementation of appropriate safeguards in specific situations and under certain conditions.[^24]

The content of the safeguards provided for by the transfer instruments needs to be adapted depending on the situation. As an illustration, the guarantees to be provided for a transfer of personal data by a processor are not the same as the ones to be provided for a transfer by a controller.[^28] Similarly, for a transfer of personal data to a controller or processor in a third country who is already subject to the GDPR for the given processing, it has to be noted that the GDPR already applies in its entirety. Therefore, for such scenario, when developing relevant transfer instruments under Article 46, namely standard contractual clauses[^29] or ad hoc contractual clauses,[^30] the Article 3 situation should be taken into account in order not to duplicate the GDPR obligations but rather to address the elements that are related specifically to the risks associated with the importer being located in a third country, e.g. to address possible conflicting national laws and government access in the third country, as well as the difficulty to enforce and obtain redress against an entity outside the EU.

Following from its obligation to be responsible for, and be able to demonstrate compliance with the data protection principles (Article 5) and to implement technical and organisational measures taking into account, inter alia, the risks with respect to the processing under Article 32 of the GDPR, a controller may very well conclude that extensive security measures are needed – or even that it would not be lawful – to conduct or proceed with a specific processing operation in a third country although there is no transfer situation. In a transfer situation, once an essentially equivalent level of protection cannot be guaranteed, the CJEU ultimately demands the transfer to be suspended or stopped.[^32]

Since the CJEU's judgment on 16 July 2020 in the so-called Schrems II case, there is no longer a valid adequacy decision by the European Commission which finds that the US provides an adequate level of protection. Therefore, in order to transfer personal data to the US in connection with the use of cloud services, you must establish appropriate safeguards e.g. enter into the SCCs with the CSP.

In summary, in the case of the US, the CJEU considered that neither Section 702 of the Foreign Intelligence Surveillance Act (FISA) nor Section E.O. 12 333, read in conjunction with the Presidential Policy Directive-28 (PPD-28), meet the proportionality requirements of EU law, with the result that surveillance programmes based on these provisions cannot be considered to be limited to what is strictly necessary. Further, the CJEU found that FISA 702 or E.O. 12 333, read in conjunction with PPD-28, does not grant the (European) data subjects rights actionable in the courts against the US authorities.

In this context, you should note that contractual and organisational measures will generally not render ineffective access to personal data by US law enforcement authorities for surveillance purposes.[^19] It will therefore be necessary to implement supplementary technical measures.

Therefore, the elements provided in this paper should be seen as the essential guarantees to be found in the third country when assessing the interference, entailed by a third country surveillance measures, with the rights to privacy and to data protection, rather than a list of elements to demonstrate that the legal regime of a third country as a whole is providing an essentially equivalent level of protection.

Thus, the level of protection of fundamental rights required by Article 46(1) of the GDPR must be determined on the basis of the provisions of that regulation, read in the light of the fundamental rights enshrined in the Charter. This being said, according to Article 52(3) of the Charter the rights contained therein which correspond to rights guaranteed by the ECHR are to have the same meaning and scope as those laid down by that Convention, and consequently, as recalled by the CJEU, the jurisprudence of the ECtHR concerning rights which are also foreseen in the Charter of Fundamental Rights of the EU must be taken into account, as a minimum threshold of protection to interpret corresponding rights in the Charter.

"[T]he operation of having personal data transferred from a Member State to a third country constitutes, in itself, processing of personal data". Thus, Articles 7 and 8 of the Charter apply to this specific operation and their protection extend to the data transferred, which is why data subjects

When data is transferred outside of the EEA, special measures must be taken to ensure that it continues to benefit from adequate protection. The range of options is set out in the DPC's guidance on international transfers. In practice, where a cloud provider is processing personal data outside of the EEA, one of the following mechanisms must be relied upon:

• The data transfer takes place based on an adequacy decision,[^1] as specified in Article 45 GDPR
• The data transfer is subject to appropriate safeguards (such as EU approved model contracts) as specified in Article 46 GDPR
• The data transfer is subject to binding corporate rules in accordance with Article 47 GDPR

Where 'model contracts' or 'binding corporate rules' are used, it is important that the protections afforded by these mechanisms also extend to any sub-processors engaged by the cloud provider.

Article 28(3) GDPR requires that processing by a processor is governed by a contract. Furthermore, as noted above, a processor is not to engage another processor without the authorisation of the controller. This means that a controller engaging a cloud provider as a processor retains control over the personal data they are processing, that there are agreed and clear limits to that processing, that the processor is clear on their obligations to the controller and that any limits to responsibility and liability for infringements or breach at the processor (cloud provider) is defined.

'The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.

(Page 13-14)

This quote outlines the principle that personal data transfers to third countries are only permitted if the third country ensures an adequate level of protection.

The Commission may find, in accordance with the procedure referred to in Article 31(2), that a third country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.

'By way of derogation from Article 25 and save where otherwise provided by domestic law governing particular cases, Member States shall provide that a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25(2) may take place on condition that:

It is clear from the express wording of Article 25(6) of Directive 95/46 that it is the legal order of the third country covered by the Commission decision that must ensure an adequate level of protection. Even though the means to which that third country has recourse, in this connection, for the purpose of ensuring such a level of protection may differ from those employed within the European Union in order to ensure that the requirements stemming from Directive 95/46 read in the light of the Charter are complied with, those means must nevertheless prove, in practice, effective in order to ensure protection essentially equivalent to that guaranteed within the European Union.

Accordingly, when examining the level of protection afforded by a third country, the Commission is obliged to assess the content of the applicable rules in that country resulting from its domestic law or international commitments and the practice designed to ensure compliance with those rules, since it must, under Article 25(2) of Directive 95/46, take account of all the circumstances surrounding a transfer of personal data to a third country.

Also, in the light of the fact that the level of protection ensured by a third country is liable to change, it is incumbent upon the Commission, after it has adopted a decision pursuant to Article 25(6) of Directive 95/46, to check periodically whether the finding relating to the adequacy of the level of protection ensured by the third country in question is still factually and legally justified. Such a check is required, in any event, when evidence gives rise to a doubt in that regard.

'Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of data concerning health or sex life.

...

4. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority.

The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the [Charter of Fundamental Rights of the European Union (Charter)] as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.

In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. ... Regarding the processing of personal data for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Member States should be allowed to maintain or introduce national provisions to further specify the application of the rules of this Regulation. ...