The following is part of Greenberg Traurig’s ongoing series analyzing cross-border data transfers in light of the new Standard Contractual Clauses approved by the European Commission in June 2021.

Visual

Description and Implications

The EDPB has taken the position that a data subject “cannot be considered a controller or processor.”1 As a result, the restrictions on cross-border data transfers that apply to controllers and processors do not apply to data subjects. In addition, the transfer of data from the EEA to the United States arguably constitutes “processing” by the data subject and, therefore, is not subject to the GDPR at all, as the regulations does not apply to processing done by a “natural person in the course of a purely personal or household activity.”2 The net result is that a controller in the United States that receives personal information directly from a data subject does not need to utilize the SCCs, or any other safeguards.

1 EDPB, Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR at n.10.

2 See GDPR, Article 2(2)(c).