GDPR in practice for North American companies: Key takeaways from Jan 21. 2021 Webinar

Home
Knowledge
GDPR in practice for North American companies: Key takeaways from Jan 21. 2021 Webinar

GDPR in practice for North American companies: Key takeaways from Jan 21. 2021 Webinar

{4EE7931E-3C94-46CD-87DA-0E681711A67F}

February 23, 2021

The General Data Protection Regulation (GDPR) was implemented in 2018 with express extraterritorial reach to organizations “not established in” the European Union (EU), raising issues on the extent and nature of scope of the GDPR application to North American companies.

Dentons hosted an insightful webinar on January 21, 2021 featuring our North American lawyers, Chantal Bernier, National Practice Lead, Privacy and Cybersecurity for Dentons Canada, Todd Daubert, Chair, Communications and Technology sectors, Dentons US and Jorge Jimenez, Partner at Dentons in Mexico. They asked questions about GDPR that are most front of mind for our clients from our European lawyers to fellow members of Dentons Global Privacy and Cybersecurity Group, Antonis Patrikios, from Dentons UK, in London, and Dr. Christian Schefold from Dentons EU, in Berlin.

Here are some key takeaways from the discussion.

Extraterritorial application of the GDPR

The EU GDPR applies to North American companies that process personal data in the context of either providing products or services to, or monitoring the behavior of, individuals in the EU. This no longer includes the UK, which as of 1 January 2021 operates its own version of the GDPR, the "UK GDPR". The UK GDPR is currently the same as the EU GDPR and the criteria regarding extra-territorial application also apply to North American companies targeting UK residents.

Generally speaking, if a company intentionally aims its products or services at individuals in the UK or the EU, then the UK/EU GDPR will apply, accordingly. Activities such as having website versions in EU languages (such as German or Italian), other content that specifically targets individuals in the EU or accepting payments in Euros could be seen as evidence of such targeting. The GDPR also applies if the online behavior of EU residents is monitored, through cookies or other tracking technology. The application of the GDPR cannot be excluded and it applies to for profit as well as not-for-profit organizations.

Application of UK GDPR

The UK GDPR is identical to the EU GDPR, but following the UK’s departure from the EU we may start to see a divergence in the interpretation and application of the respective regulations. It is expected that the UK will gradually start deviating its legal regime from that of EU, most likely in the interpretation coming from regulators and authorities who will diverge from the interpretation of same authorities in the EU.

Companies operating within the EU and the UK must also be mindful of the intra EU – UK operability, because the UK is now considered a third country under the EU GDPR and it does not (yet) have adequacy status. However, this is expected imminently. Therefore, disruption to EU – UK data exports is unlikely in the foreseeable future. Nevertheless, North American companies operating in both the EU and the UK but only having an establishment in one of these regions, may now need to appoint a data protection representative in the region in which they do not have an establishment.

Application of GDPR compared to CCPA

The volume of personal data processed is not a factor in the application of the GDPR. The GDPR can be contrasted with the California Consumer Protection Act (CCPA), which applies to entities processing personal information of Californian residents, but it has a threshold (based on profit or volume of processing). Processing larger volumes of personal data from the UK / EU may certainly affect the level of interest of UK / EU data privacy regulators and the overall risk associated with such processing, but not application of the GDPR.

Key principles of GDPR

North American companies must address compliance with GDPR taking into account that the protection of privacy is a human right in the EU. It follows that under GDPR personal data can only be processed for a legitimate purpose.

North American companies with activities in the EU must comply with the transparency and accountability mandate by providing compliant notice to individuals about their processing activities and by keeping evidence (in the form of documented policies, risk assessments, data processing records, etc.) of how they achieve compliance.

The GDPR principles of minimization and storage limitation mandate that organizations should only collect data needed for the purpose for which it is collected and store it only as long as required for that purpose.

North American companies processing personal data from the EU must also implement internal mechanisms for the exercise of the rights of data subjects including the rights to access, portability, correction, deletion, objection and restriction of processing. This includes ensuring that data is kept accurate, up to date and either erased or corrected when inaccurate.

As in North America, the GDPR requires organizations to have appropriate security measures in place to protect the personal data they hold and deal with data breaches swiftly and efficiently when they happen.

Enforcement under GDPR

The fines for noncompliance with the GDPR can be quite significant, but so far, fines for companies with no establishment in the EU have been minimal, if any at all.

The legal risk is low for companies without presence in the EU or the UK. If the company does not have a presence in the EU/UK and it has not appointed a data protection representative, there is not much that the EU/UK regulators can do in practice to enforce their fines. On the other hand, companies with subsidiaries established in the EU or the UK or who have appointed a data protection representative are more exposed to legal risks because these entities could become the subject of direct enforcement from the EU or UK regulators, without the need to proceed through international judicial cooperation procedures.

It should be noted that national Data protection authorities are well coordinated and may cooperate based on memoranda of understanding to share information. There is also the Global Privacy Enforcement Network where regulators share information. Regulators have undertaken joint or coordinated investigations if companies operate in different jurisdictions.

Authorities and regulators are generally not and should not be politically motivated when targeting companies. Their mandate is to be independent and to discharge public duties in accordance with public and administrative law and good regulation principles. However, regulators often follow the public sentiment and investigate issues that are front and center in people’s minds and most investigations start with a complaint of a data subject.

Factors connecting the organization to EU entities can be mitigated to enable a clearer positioning of the organization outside the extraterritorial application of the GDPR. The GDPR will only apply to that part of the business that processes personal data about individuals in the EU / UK, not to the entire business operations. For decentralized entities, such as crypto startups for example, the GDPR applies depending on the role that the entity has in the ecosystem, the type of data (whether personal or not) and the type of blockchain employed.

Besides the obvious exposure to legal fines under the GDPR, organizations should consider the risk of reputational damage, the risk of litigation and the risk that they may become the target of activists or public advocacy groups.

Transfers of personal data from the EU / UK – the impact of the invalidation of the EU-US Privacy Shield in July 2020

The invalidation of the EU-US Privacy Shield by the Court of Justice of the EU (CJEU) on July 16.2020, means that all US companies that were receiving personal data on the basis of certification under the Privacy Shield have to adopt a new form of authorization to do so. Most common are the EU Commission Standard Contractual Clauses (SCCs).

The impact on Canadian companies only arises where the company transfers the EU data to a US service provider. That is because Canada has partial adequacy status from the European Commission and any transfers of personal data from the EU to Canada can be made based on the adequacy decision.

Mexican companies are less impacted by the decision because Mexico does not have adequacy status and therefore always received personal data from the EU through Standard Contractual Clauses (SCCs).

US companies, on the other hand, are significantly impacted. By invalidating the EU-US Privacy Shield, the CJEU ruled that the Privacy Shield did not offer adequate protection for EU data and that the SCCs are valid but not sufficient requiring organizations to carry out risk assessments and employ additional protections when transferring data to the US. To assist companies in doing so, Dentons developed the Dentons Transfer Impact Assessment Methodology.

It is expected that practical solutions to address the shortcomings identified in the Schrems II decision will be coming soon. The latest "noises" from EU data protection regulators suggest that, in the end, the steps that most organizations will be expected to take will be less onerous than initially thought. The UK is expected to be even more pragmatic in its approach. However, certain controls must be put in place to ensure protection of personal data.

In addition, the new Biden/Harris administration in the US is expected to bring changes towards the EU and the UK and hopefully renewed discussions will ensue to address the glaring gap in transatlantic data exports created by Schrems II.

Dentons is pleased to provide you with the Schrems II Source Kit that addresses key questions Canadian companies with business in Europe must now pay attention to. To view the webinar please click here.

If you have any questions or would like to know more, please contact us: