FRANCE Law and Practice Contributed by: Frédéric Sardain and Claire Allavena, Jeantet
CNIL guidance In France, the CNIL has provided guidance on implementing new SCCs and emphasised the necessity of conducting thorough assessments of data protection laws in third countries when utilising SCCs for international transfers. Prompting Additional Safeguards Risk assessments (TRA) are essential for organi - sations following the invalidation of the Privacy Shield and the implications of the Schrems II rul - ing. These assessments help evaluate whether the legal framework of the importing country offers adequate data protection. Organisations are encouraged to implement supplementary measures alongside SCCs or other safeguards when transferring data to jurisdictions considered inadequate. This may include encryption, pseudonymisation, or addi - tional contractual clauses. New EU-US Data Transfer Framework Following the invalidation of the Privacy Shield, ongoing discussions between EU and US authorities have aimed to establish a new trans- atlantic data transfer framework to address the concerns raised in the Schrems II ruling. Efforts continue to create a stable framework that aligns with EU data protection standards while enabling data flows between the USA and EU member states. However, no final agreement has been reached. The EU-US Data Privacy Framework now regu - lates data transfers between the USA and the European Union.
demands of foreign courts. However, in practice, the French Blocking Statute seems to have been only relatively effective in preventing such com - munications. 5.5 Recent Developments Recent developments in France’s regulation of the international transfer of personal data reflect ongoing changes in the European data protec - tion landscape. The CJEU issued its landmark ruling in July 2020, invalidating the EU-US Privacy Shield framework, which previously allowed for the transfer of personal data between the EU and the United States This ruling emphasised con - cerns regarding US surveillance practices and the lack of comparable protection for EU citi - zens’ data rights. Post-Schrems II Context Schrems II ruling (2020) Implications for Transfers: Following the ruling, organisations faced increased scrutiny and chal - lenges when transferring personal data to the United States and other third countries without an adequate decision, necessitating appropri - ate safeguards such as Standard Contractual Clauses (SCCs). Updated Standard Contractual Clauses (SCCs) New SCCs In June 2021, the European Commission adopt - ed new Standard Contractual Clauses, replacing the previous versions. These updated clauses provide a more flexible and comprehensive framework for organisations to establish com - pliance with data protection and privacy laws when transferring personal data internationally.
138 CHAMBERS.COM
Powered by FlippingBook