The following is part of Greenberg Traurig’s ongoing series analyzing cross-border data transfers in light of the new Standard Contractual Clauses approved by the European Commission in June 2021.
Background. Company A is a European legal entity that does not have a legal presence in Country Q. Company A has an employee that works from Country Q (e.g., a remote worker or a travelling employee).
Transfer 1: No mechanism needed for transfer from Company A to its employee outside of the EEA. The EDPB has suggested that when a company transmits personal data to an employee located outside of the EEA, the transmission does not constitute a “transfer” of personal information for purposes of Chapter V of the GDPR because the data has not been sent to a separate controller or processor.1 While the EDPB provided, as an example, the use-case where an employee travels for work to India where he remotely accesses personal data from the EEA, the EDPB’s rationale may apply equally to other remote-work situations such as an employee that resides in a non-EEA country, or a remote employee that downloads personal data (as opposed to remotely accesses such data).
Transfer Impact Assessments. The EDPB has suggested that a controller (Company A) is “accountable for [its] processing activities” which include assessing risks “to conduct or proceed with a specific processing operation in a third country although there is no ‘transfer’ situation.”2 As a result, Company A might...
GB News presenter Alex Armstrong and right-wing social media commentator Bernadette Spofforth have apologised and paid substantial damages to Green Party deputy leader Mothin Ali after falsely sug...