 |
|
Cross-Border Transfer Master Class: Transfers from EEA Controller to Non-EEA Controller: Controller (EEA) → Controller (EEA) → Affiliated Controller (US)
 |
|
Cross-Border Transfer Master Class: Transfers from EEA Controller to non-EEA Controller: Controller (EEA) → Controller (U.S.) → Processor (Non-EEA)
| Visual | Implications |
 |
|
Cross-border Transfer Master Class: Does a U.S. controller need to use the SCCs when it onward transfers data received from a European to a non-EEA processor?
Companies are allowed to transfer personal data outside the European Economic Area (EEA) if they are (1) transferring data to an entity that is within a country that has been recognized by the European Commission as ensuring an adequate level of protection or (2) they have put in place a European Commission-approved mechanism (a “safeguard”)
Under California Data-Privacy Laws, Is a ‘Service Provider’ the Same as ‘Processor’?
No. The European GDPR does not use the term “service provider” and, instead, refers to “processors.” Click here to read the full answer, published by the Washington Legal Foundation.
Cross-border transfer master class: Does a US controller need to use the SCCs when it onward transfers data received from a European to a controller in another country?
Companies are allowed to transfer personal data outside the European Economic Area (EEA) if they are (1) transferring data to an entity that is within a country that has been recognized by the European Commission as ensuring an adequate level of protection or (2) they have put in place a European Commission-approved mechanism (a “safeguard”)
Cross-Border Transfer Master Class: Onward Transfers from Controllers in the US to Another Controller in the US
Companies are allowed to transfer personal data outside the European Economic Area (EEA) if they are (1) transferring data to an entity within a country recognized by the European Commission as ensuring an adequate level of protection or (2) they have put in place a European Commission-approved mechanism (a “safeguard”) that imposes many of the
When a European Union data subject transmits data directly to a US company, is an adequacy measure required?
No.
The GDPR requires that when a “controller or processor … transfer[s] … data to a third country” that is not considered to have data protection laws analogous to those within the European Union, it utilizes an adequacy measures.[1] In situations where an individual within the European Union is initiating the transfer to a
What is considered sensitive personal information?
Some privacy statutes explicitly reference “sensitive” or “special” categories of personal information. While such terms, when used, often include similar data types that are generally considered as raising greater privacy risks to data subjects if disclosed, the exact categories that fall under those rubrics differ between and among statutes. Furthermore, other privacy statutes do not
Tomato, to-ma-toe: Is CCPA deidentification the same thing as GDPR anonymization?
Deidentified information is defined within the CCPA to refer to information that “cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer” provided that a business that uses deidentified information takes four operational and organizational steps to ensure that such information is not