Germany – Schrems II: German court overturns presumption of international data transfer from EU-subsidiary to non-EU parent company | Allen & Overy LLP & More Latest News Here


On 13 July 2022, the Public Procurement Chamber of the German state of Baden-Württemberg (the Public Procurement Chamber) issued a decision confirming that personal data processed by an EU subsidiary of a parent entity incorporated in a third country should be considered as being transferred outside the EU (the Decision).

It held that a transfer of data outside the EU takes place where there is a chance that the personal data may be accessed from outside the EU, even if the data is never actually accessed from outside the EU as a matter of fact. On 7 September 2022, this decision was overturned by the Karlsruhe Higher Regional Court (the OLG Karlsruhe).

The Public Procurement Chamber Decision

The Decision arose in the context of the Schrems II judgment of the CJEU. Public procurement chambers in Germany provide an independent review of public tender procedures and award of public contracts. In present case, the public tender requirements included the use of the cloud with the physical location of data in the EEA. The contract was awarded to a contractor intending to use a Luxembourg-based subsidiary of a US cloud provider, with an agreed physical server location to be in Germany. The Public Procurement Chamber concluded that processing personal data on an EU based platform with the mere possibility that data could be accessed by the US parent company constitutes a transfer within the meaning of Article 44 GDPR and a latent risk of access to data by the US authorities cannot be sufficiently contained by contractual provisions on confidentiality of customer data or obligations to challenge excessive governmental access requests. This transfer, was therefore, considered to violate the GDPR taking into account the heightened regulatory scrutiny following Schrems II for US data transfers, and the Chamber’s view that the infrastructure services of the European subsidiaries of a US cloud provider cannot be used in the public procurement procedure in question.

DPA criticizes the Decision

On 15 August 2022, the Baden-Württemberg supervisory authority (DPA) issued a statement noting that the Decision might have far-reaching significance going beyond the original procedure. The DPA found equating the risk of access with actual transmission (as part of the definition of “processing” under Art. 4(2) GDPR) to be legally questionable and had disregarded the risk-based approach of the GDPR. The DPA also considered that the Decision also did not take into account the possibility of the parties implementing technical and organisational measures to mitigate or ultimately exclude any risk, for instance, through the use of encryption technology.

The DPA further pointed out that the Public Procurement Chamber focused on the old standard contractual clauses (SCCs) and did not consider the new SCCs adopted by the European Commission in June 2021, which take into account the requirements of Schrems II. The DPA concluded that it continues to adhere to its guidance on international data transfers, requiring case-by-case assessments of intended transfers by data exporters rather than a blanket ban on transfers suggested by the Decision.

The OLG Karlsruhe: no presumption that an EU subsidiary of a cloud provider would violate binding contractual commitments or EU law

In an appeal procedure, the OLG Karlsruhe overturned the Decision of the Public Procurement Chamber. It did not see reasons to doubt that a tenderer would fulfil its contractual commitments. It reasoned that clear assurances from the service provider about the content of its contract with the Luxembourg-based subsidiary of a US cloud provider (i.e. to have data only transferred to the Luxembourg entity and processed only in Germany) should be sufficient and contracting authorities should not presume that a European subsidiary would follow unlawful instructions of the US parent company to transfer personal data to the US in breach of contract and in violation of EU law.

The OLG Karlsruhe did not address the argument of the Public Procurement Chamber that a mere possibility of accessing data from outside the EU by a US parent company would constitute a transfer within the meaning of Article 44 GDPR, however, the OLG Karlsruhe noted that with the contractual assurances, as in the present case, there should be no assumption about a transfer of personal data to the US.

The decision of the OLG Karlsruhe is final.

Read the Decision, the DPA statement, the decision of OLG Karlsruhe and their press release (all documents only in German).

Germany – Schrems II: German court overturns presumption of international data transfer from EU-subsidiary to non-EU parent company | Allen & Overy LLP & Latest News Update

I have tried to give all kinds of news to all of you latest news today 2022 through this website and you are going to like all this news very much because all the news we always give in this news is always there. It is on trending topic and whatever the latest news was

it was always our effort to reach you that you keep getting the Electricity News, Degree News, Donate News, Bitcoin News, Trading News, Real Estate News, Gaming News, Trending News, Digital Marketing, Telecom News, Beauty News, Banking News, Travel News, Health News, Cryptocurrency News, Claim News latest news and you always keep getting the information of news through us for free and also tell you people. Give that whatever information related to other types of news will be

Germany – Schrems II: German court overturns presumption of international data transfer from EU-subsidiary to non-EU parent company | Allen & Overy LLP & More Live News

All this news that I have made and shared for you people, you will like it very much and in it we keep bringing topics for you people like every time so that you keep getting news information like trending topics and you It is our goal to be able to get

all kinds of news without going through us so that we can reach you the latest and best news for free so that you can move ahead further by getting the information of that news together with you. Later on, we will continue

to give information about more today world news update types of latest news through posts on our website so that you always keep moving forward in that news and whatever kind of information will be there, it will definitely be conveyed to you people.

Germany – Schrems II: German court overturns presumption of international data transfer from EU-subsidiary to non-EU parent company | Allen & Overy LLP & More News Today

All this news that I have brought up to you or will be the most different and best news that you people are not going to get anywhere, along with the information Trending News, Breaking News, Health News, Science News, Sports News, Entertainment News, Technology News, Business News, World News of this made available to all of you so that you are always connected with the news, stay ahead in the matter and keep getting today news all types of news for free till today so that you can get the news by getting it. Always take two steps forward

News – Times . This Is Not My Content So If You Want To Read Original Content You Can Follow Below Links🡽

Back to top button