The following is part of Greenberg Traurig’s ongoing series analyzing cross-border data transfers in light of the new Standard Contractual Clauses approved by the European Commission in June 2021.

Controller (EEA)→ Controller (EEA)→ Branch Office (US)
  • Background. Company B is a European entity, that has a branch office in the United States (which is not a separate legal entity). While data

Ian Ballon, co-chair of GT’s Global Intellectual Property & Technology Practice Group, will chair PLI’s Advanced Data Privacy, Cybersecurity and TCPA Class Action Litigation 2022 program on Jan. 21. The program will address the hottest trends, latest case law, and most important strategy decisions that companies and their counsel need to know for 2022.

  • Background. Company B-1 and Company B-2 are corporate affiliates who are under common ownership or control but are separate legal entities. Company B-2 is the processor of Company B-1. While data is being directly sent from Company A in Europe to Company B-2, Company B-2 is not acting as the processor of Company A;

  • Background. Company B-1 and Company B-2 are corporate affiliates who are under common ownership or control but are separate legal entities. While data is being directly sent from Controller A in Europe to Controller B-2 in the United States, Controller A has contracted only with Controller B-1 in Europe. Solid line indicates the data

Visual Implications
  • 1st SCC Module 1. Initial cross-border transfer from Company A to Company B utilizes the SCC Module 1 designed for transfers from a controller to a non-EEA Controller.
  • 2nd SCC Module 2. Pursuant to Section 8.7 of the 1st SCC, all subsequent onward transfers to non-adequate jurisdictions must also utilize the

Visual Implications
  • 1st SCC Module 1. Initial cross-border transfer from Company A to Company B utilizes the SCC Module 1 designed for transfers from a controller to a non-EEA Controller (1st SCC).
  • 2nd SCC Module 2. Pursuant to Section 8.7 of the 1st SCC, all subsequent onward transfers to non-adequate jurisdictions must also

Companies are allowed to transfer personal data outside the European Economic Area (EEA) if they are (1) transferring data to an entity that is within a country that has been recognized by the European Commission as ensuring an adequate level of protection or (2) they have put in place a European Commission-approved mechanism (a “safeguard”)

The new Telecommunications Telemedia Data Protection Act (TTDSG) (link in German) is the result of a clean-up campaign in German data protection law. The TTDSG, which became effective 1 December 2021, merges the data protection regulations in telemedia and telecommunications law that were previously scattered across a wide array of German laws.

Click

David A. Zetoony, a shareholder of global law firm Greenberg Traurig, LLP, is recognized as a 2021 “Go-To Thought Leader” for Privacy Law by The National Law Review (NLR). This recognition is based on NLR’s analysis of more than 20,000 pieces of thought leadership.

According to NLR, a database of legal