Burger

Schrems II FAQs

FAQs

The Schrems II Webinar - Lawful Data Transfer - with NOYB, EDPS and industry experts was held on 8 October 2020. Over 2,300 registered and submitted over 900 questions. These 900+ questions were distilled down to the top Frequently Asked Questions (FAQs). These FAQs are being posted to the LinkedIn Schrems II group for comments by the community. If you are not already a member of the Schrems II LinkedIn group, we encourage you to join to learn and participate in the discussion. A summary, transcript and replay of the webinar can be viewed at SchremsII.com/learn.

Webinar FAQ 1: Are BCRs similarly affected by Schrems II like SCCs?
4 min
Webinar FAQ 1: Are BCRs similarly affected by Schrems II like SCCs?

Under Schrems II, both BCRs & SCCs require additional safeguards to ensure that foreign laws do not impinge on the EU level of protection they guarantee.

(CLICK TO READ MORE)
Webinar FAQ 2: Do Boards of Directors and stockholders need to be made aware of Schrems II? What about Financial auditors and vertical industry regulators?
3 min
Webinar FAQ 2: Do Boards of Directors and stockholders need to be made aware of Schrems II? What about Financial auditors and vertical industry regulators?

Due to potential material adverse impacts of Schrems II noncompliance, consult with legal counsel regarding your obligation to disclose facts to internal and external stakeholders to avoid potential liability.

(CLICK TO READ MORE)
Webinar FAQ 3: Do Additional Safeguards enable Schrems II Compliant EU employee data processing?
2 min
Webinar FAQ 3: Do Additional Safeguards enable Schrems II Compliant EU employee data processing?

Yes. If you are already practicing Data Protection by Design and By Default, most employee-related processing involving EU personal data can continue using additional safeguards like GDPR-heightened Pseudonymisation.

(CLICK TO READ MORE)
Webinar FAQ 4: Can I rely on statements by US and other non-EEA/Equivalency Country cloud providers that their Standard Contractual Clauses (SCCs) enable lawful data transfer under Schrems II?
4 min
Webinar FAQ 4: Can I rely on statements by US and other non-EEA/Equivalency Country cloud providers that their Standard Contractual Clauses (SCCs) enable lawful data transfer under Schrems II?

No. Data controllers have an affirmative obligation to ensure that SCCs are augmented with “supplementary measures” that ensure protection equivalent to EU data protection laws. This obligation remains the sole obligation of a data controller under Schrems II unless it is expressly assumed by a cloud provider, in which case it becomes a shared responsibility of the parties.

(CLICK TO READ MORE)
Webinar FAQ 5: Explain how the GDPR heightened standard for Pseudonymisation is not the same as the casual understanding of the technique.
3 min
Webinar FAQ 5: Explain how the GDPR heightened standard for Pseudonymisation is not the same as the "casual" understanding of the technique.

The GDPR definition of Pseudonymisation is very different from the pre-GDPR "casual" understanding of the term – you must now satisfy dramatically heightened requirements.

(CLICK TO READ MORE)
Webinar FAQ 6: Data Pseudonymisation 101 Overview
3 min
Webinar FAQ 6: Data Pseudonymisation 101 Overview

The GDPR expressly awards certain benefits to the use of GDPR-compliant Pseudonymisation

(CLICK TO READ MORE)
Webinar FAQ 7: Is GDPR-Grade Anonymisation Technically Possible?
2 min
Webinar FAQ 7: Is GDPR-Grade Anonymisation Technically Possible?

Anonymisation is a high-risk, short-term strategy. It is no silver bullet. It is difficult if not impossible to achieve in the age of big data, machine learning, and quickly interconnect data sources.

(CLICK TO READ MORE)