Guides post-Schrems II Transfer Impact Assessments using EDPB Recommendations 01/2020 six-step process. For international data transfers, SCCs evaluation, third-country laws, and supplementary measures.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
Following the Court of Justice of the European Union (CJEU) judgment in Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18, 16 July 2020) — commonly known as Schrems II — controllers and processors transferring personal data outside the EEA must assess whether the legal framework of the destination country provides an essentially equivalent level of protectio...
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
Following the Court of Justice of the European Union (CJEU) judgment in Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18, 16 July 2020) — commonly known as Schrems II — controllers and processors transferring personal data outside the EEA must assess whether the legal framework of the destination country provides an essentially equivalent level of protection to that guaranteed by the GDPR and the EU Charter of Fundamental Rights. This assessment is known as a Transfer Impact Assessment (TIA). The European Data Protection Board adopted Recommendations 01/2020 on 18 June 2021, establishing a six-step process for conducting TIAs.
The EDPB established a structured methodology for evaluating whether transfers can proceed:
Map all transfers of personal data to third countries or international organisations:
| Transfer Attribute | Documentation Required |
|---|---|
| Data exporter | Legal entity, establishment, contact details |
| Data importer | Legal entity, country of establishment, sector |
| Personal data categories | Specific categories transferred (identifiers, financial, health, behavioural) |
| Special categories | Whether Art. 9 or Art. 10 data is transferred |
| Data subjects | Categories and approximate number |
| Transfer mechanism | SCCs, BCRs, Art. 49 derogation, adequacy decision |
| Purpose of transfer | Specific purposes for which data is transferred |
| Onward transfers | Whether importer transfers data to further third countries |
| Format | Whether data is transferred in clear text, pseudonymised, or encrypted |
| Storage vs transit | Whether data is stored in third country or only transits through it |
| Transfer Mechanism | GDPR Reference | Assessment Requirement |
|---|---|---|
| Adequacy decision | Art. 45 | Rely on Commission assessment; monitor for future invalidation |
| Standard Contractual Clauses (new 2021 SCCs) | Art. 46(2)(c) | Full TIA required per CJEU C-311/18 |
| Binding Corporate Rules | Art. 47 | Full TIA required; BCRs must include supplementary measures |
| Codes of conduct with binding commitments | Art. 46(2)(e) | Full TIA required |
| Certification mechanisms | Art. 46(2)(f) | Full TIA required |
| Ad hoc contractual clauses | Art. 46(3)(a) | Full TIA required plus supervisory authority authorisation |
| Art. 49 derogations | Art. 49 | No TIA required but strict conditions apply; derogations must be interpreted restrictively |
Evaluate whether the destination country's laws and practices provide essentially equivalent protection. Key assessment areas:
| Assessment Factor | Questions to Address |
|---|---|
| Surveillance legislation | What laws authorise government access to personal data held by private entities? |
| Scope of access powers | Is access limited to what is strictly necessary and proportionate, or does it enable bulk/indiscriminate collection? |
| Independent oversight | Is government access subject to prior authorisation by an independent body (court or independent administrative authority)? |
| Transparency | Are data subjects notified of government access, either directly or through transparency reporting? |
| Effective remedies | Do data subjects have access to an independent tribunal or court to challenge government access? |
| Assessment Factor | Questions to Address |
|---|---|
| Constitutional protections | Does the country's constitution protect the right to privacy and data protection? |
| Data protection legislation | Does the country have comprehensive data protection legislation? |
| Independent supervisory authority | Is there an independent data protection authority with enforcement powers? |
| Judicial independence | Is the judiciary independent from the executive, with power to review government surveillance? |
| Assessment Factor | Sources of Information |
|---|---|
| Government access requests | Transparency reports from the data importer and major technology companies |
| Enforcement actions | Published decisions of the destination country's data protection authority |
| Legal reforms | Pending or recent legislative changes affecting surveillance powers |
| International assessments | EDPB adequacy referentials, CoE Convention 108+ ratification status |
Where the assessment in Step 3 reveals that the third country framework does not provide essentially equivalent protection, the exporter must identify supplementary measures that, together with the transfer tool, ensure essentially equivalent protection.
| Measure | EDPB Assessment | Effective Against |
|---|---|---|
| End-to-end encryption where exporter holds the key | Effective — prevents importer and government access to clear text data | Government access via importer; importer misuse |
| Pseudonymisation where exporter holds the mapping table | Effective — if additional information needed to re-identify is held solely in EEA | Government access where re-identification requires mapping table |
| Split processing across jurisdictions | Effective — if no single jurisdiction has access to complete dataset | Government access in any single jurisdiction |
| Transport encryption (TLS/IPSEC) for data in transit | Insufficient alone — protects only against interception during transit, not access at rest | Transit interception only |
| Encryption at rest where importer holds decryption key | Insufficient — importer can be compelled to provide decryption key | Not effective against government compulsion |
| Measure | Purpose |
|---|---|
| Obligation to use all available legal remedies to challenge government access requests | Ensures importer resists unlawful government access |
| Warrant canary or transparency reporting obligations | Enables exporter to detect government access |
| Obligation to notify exporter of government access requests (where legally permitted) | Enables exporter to intervene or suspend transfers |
| Obligation to conduct annual assessment of government access laws | Ensures ongoing monitoring of legal framework changes |
| Contractual right for exporter to audit importer's compliance | Enables verification of supplementary measure effectiveness |
| Measure | Purpose |
|---|---|
| Adoption of internal policies and procedures for handling government access requests | Ensures structured response to government demands |
| Appointment of a DPO or privacy officer by the importer | Ensures designated responsibility for compliance |
| Staff training on government access response procedures | Ensures operational readiness |
| Regular external audits of government access request handling | Independent verification of compliance |
| Factor | Weight | Score 1 (Low Risk) | Score 3 (Medium Risk) | Score 5 (High Risk) |
|---|---|---|---|---|
| Surveillance legislation scope | 25% | Targeted access only, strictly necessary and proportionate | Mix of targeted and bulk powers, some proportionality limitations | Bulk/indiscriminate access powers without proportionality requirements |
| Independent prior authorisation | 20% | Judicial authorisation required for all access | Judicial authorisation for some; administrative for others | No independent authorisation required; self-authorisation |
| Effective remedies | 20% | Independent court with full review powers, accessible to foreign nationals | Administrative review body with limited powers | No effective remedy available to foreign nationals |
| Transparency and notification | 15% | Mandatory notification and public transparency reporting | Partial transparency; notification in some cases | No notification obligation; limited or no transparency |
| Rule of law and judicial independence | 20% | Strong constitutional protections; independent judiciary; ratified CoE 108+ | Some constitutional protections; judiciary generally independent | Weak or absent constitutional protections; executive influence over judiciary |
| Total Weighted Score | Risk Level | Recommendation |
|---|---|---|
| 1.0 — 2.0 | Low | Transfer may proceed with standard transfer tool |
| 2.1 — 3.0 | Medium | Transfer may proceed with appropriate supplementary measures |
| 3.1 — 4.0 | High | Transfer may proceed only with robust technical supplementary measures (encryption with exporter-held key, pseudonymisation) |
| 4.1 — 5.0 | Very High | Transfer should not proceed unless data is encrypted with exporter-held key and importer has no access to clear text data |