Strict EU rules on the international transfer of personal data do not apply when employees access data from their company’s database remotely while on business trips in other parts of the world, a data protection watchdog has confirmed.
The example is explained in new guidance the European Data Protection Board (EDPB) is currently consulting on (9-page / 168KB PDF), which concerns the territorial scope of the rules on international data transfers under the General Data Protection Regulation (GDPR).
Both the EU and UK GDPR impose strict conditions on the transfer of personal data outside of the jurisdiction – in the EU’s case, the European Economic Area (EEA). While the European Commission has put in place so-called adequacy agreements to enable data to flow freely from the EEA to certain ‘third countries’ that it deems have essentially equivalent data protection regimes to that in place in the EU, including the UK, in many cases businesses must carry out a transfer impact assessment and turn to legal tools such as standard contractual clauses as a means of providing for EU data protection standards to be applied to personal data transferred outside of the EEA.
The EDPB’s draft guidance attempts to help businesses understand which activities constitute data transfers to which the strict conditions apply. There is uncertainty over the matter because the GDPR does not define what is meant by a transfer of personal data to a third country or to an international organisation....
The U.S. Department of Justice on Thursday announced charges against 15 people, including six medical professionals, for allegedly participating in schemes that collectively submitted $2 billion i...