Guides implementing technical, contractual, and organisational supplementary measures for EU international data transfers per EDPB Recommendations 01/2020. Covers encryption, pseudonymisation, audit rights, and policies.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
EDPB Recommendations 01/2020 (Version 2.0, adopted 18 June 2021) establish that where a Transfer Impact Assessment reveals protection gaps in the destination country's legal framework, supplementary measures must be adopted to bring the level of protection up to the EU standard of essential equivalence. These measures fall into three categories: technical, contractual, and organisational. The m...
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
EDPB Recommendations 01/2020 (Version 2.0, adopted 18 June 2021) establish that where a Transfer Impact Assessment reveals protection gaps in the destination country's legal framework, supplementary measures must be adopted to bring the level of protection up to the EU standard of essential equivalence. These measures fall into three categories: technical, contractual, and organisational. The measures must be effective in practice — not merely theoretical — and their effectiveness must be reassessed at appropriate intervals.
Description: Personal data is encrypted before leaving the EU/EEA using strong encryption algorithms, with decryption keys held exclusively by the data exporter or a trusted entity within the EU/EEA. The data importer in the third country receives and stores only ciphertext.
Technical specification at Athena Global Logistics:
Effectiveness: High — the third-country government cannot compel the importer to produce plaintext data because the importer does not possess the decryption keys. This measure is effective against compelled disclosure at rest and in transit.
Limitation: Only applicable where the importer does not need to process the data in plaintext. If the importer must read, analyse, or transform the data, this measure alone is insufficient.
Applicable scenario: Backup storage, archival, and transit-only scenarios where the importer serves as a conduit or storage provider.
Description: Directly identifying personal data elements are replaced with pseudonymous identifiers before transfer. The mapping table linking pseudonyms to real identities is held exclusively by the data exporter within the EU/EEA.
Technical specification at Athena Global Logistics:
Effectiveness: High — the transferred dataset cannot be attributed to identified natural persons by the importer or any third party (including government authorities) without access to the mapping table.
Limitation: Requires that the importer can fulfil its processing purpose without accessing the original identifying data. Not suitable where the importer must contact data subjects directly or produce documentation bearing real names.
Description: The processing operation is divided such that no single entity in the third country holds the complete dataset. Each fragment, viewed in isolation, does not constitute personal data or cannot be attributed to an identified individual.
Technical specification at Athena Global Logistics:
Effectiveness: High — neither the importer nor the destination country government can reconstruct the full personal dataset from the transferred fragment alone.
Limitation: Requires significant architectural investment and may reduce the importer's processing efficiency. Applicable only where the processing can be meaningfully divided.
Description: All data transfers are protected by transport-layer security (TLS 1.3 or equivalent) to prevent interception in transit.
Technical specification at Athena Global Logistics:
Effectiveness: Medium — protects data against interception in transit by third parties but does not protect against compelled disclosure of data at rest by the importer or government authorities accessing the importer's systems.
Applicable as: Baseline measure for all transfers, combined with other measures for comprehensive protection.
Description: Personal data is irreversibly anonymised before transfer, rendering the transferred dataset outside the scope of the GDPR (Recital 26).
Technical specification at Athena Global Logistics:
Effectiveness: Complete — anonymised data is not personal data and Chapter V transfer rules do not apply. However, the utility of the data for the importer may be significantly reduced.
Contractual clause: The data importer undertakes to challenge any government access request that: (a) is disproportionate to the stated legal objective; (b) exceeds the scope authorised by the applicable legislation; (c) is incompatible with the protections afforded by the SCCs. The importer shall exhaust all available legal remedies before disclosing any data in response to a government request.
Implementation at Athena Global Logistics: Included as Clause 3.1 of the SCC Supplementary Measures Addendum executed with TransPacific Freight Solutions Ltd on 15 March 2025.
Contractual clause: The data importer shall notify the data exporter within 48 hours of receiving any government access request relating to transferred personal data. Where local law prohibits notification, the importer shall use best efforts to obtain a waiver of the prohibition and shall, at minimum, provide aggregated statistical information about government requests received on an annual basis.
Implementation: Included as Clause 3.2 of the SCC Supplementary Measures Addendum. Additionally, TransPacific Freight Solutions publishes an annual transparency report covering all government data access requests by jurisdiction and legal basis.
Contractual clause: The data exporter or its designated independent auditor has the right to conduct on-site or remote audits of the data importer's data processing facilities, systems, and records at least once during each 12-month period, with 30 days' prior written notice. The importer shall cooperate fully with the audit and provide access to all relevant personnel, systems, and documentation.
Implementation: Included in SCC Clause 8.9 and supplemented by Clause 3.3 of the Addendum specifying the audit scope, methodology, and reporting requirements.
Contractual clause: The data importer shall publish a monthly statement confirming that, during the preceding month, it has not received any government order that would require the disclosure of transferred personal data under circumstances that would prevent notification to the data exporter. The absence of such a statement shall serve as notice to the exporter.
Implementation: TransPacific Freight Solutions publishes the warrant canary statement on the 5th business day of each month on a dedicated page of its corporate website accessible to Athena Global Logistics.
Contractual clause: The data importer shall not transfer, store, or process the transferred personal data in any jurisdiction other than the agreed destination country (Hong Kong SAR) without the prior written consent of the data exporter. Sub-processor processing in other jurisdictions requires execution of separate SCCs or equivalent safeguards.
Implementation: Included as Clause 3.5 of the Addendum; enforced through technical controls restricting data replication to the Hong Kong data centre only.
Description: The data importer implements strict role-based access controls limiting data access to the minimum number of named personnel with a documented business need.
Implementation at TransPacific Freight Solutions:
Description: The data importer publishes periodic transparency reports detailing the number and nature of government data access requests received, to the extent permitted by local law.
Implementation: Annual transparency report published in Q1 covering the preceding calendar year. Report includes: number of requests by jurisdiction, legal basis cited, data categories requested, and outcome (full disclosure, partial disclosure, challenge, withdrawal).
Description: The data importer obtains and maintains independent certification against ISO 27001:2022 (information security) and ISO 27701:2019 (privacy information management), providing third-party verification that technical and organisational measures meet international standards.
Implementation: TransPacific Freight Solutions certified to ISO 27001:2022 (certificate valid to 31 December 2026) and ISO 27701:2019 (certificate valid to 31 December 2026). Surveillance audits conducted annually by TUV Rheinland.
Description: Documented procedure for the importer to escalate data protection incidents, including government access events, to the exporter within defined timeframes.
Implementation:
| Measure | Technical Risk Addressed | Effectiveness Against Compelled Disclosure | Effectiveness Against Bulk Surveillance | Residual Risk |
|---|---|---|---|---|
| T1 — E2E encryption with EU keys | Data at rest and in transit | High | High | None if keys remain in EU |
| T2 — Pseudonymisation | Re-identification | High | High | Low — sophisticated attacks may enable re-identification through auxiliary data |
| T3 — Split processing | Complete dataset exposure | High | High | Low — requires careful architecture to prevent fragment recombination |
| T4 — TLS 1.3 | Transit interception | High (transit only) | Medium | Medium — does not protect at rest |
| T5 — Anonymisation | All — data is no longer personal | Complete | Complete | None — but utility is reduced |
| C1 — Challenge obligation | Disproportionate requests | Medium | Low | Medium — effectiveness depends on importer's legal standing and judiciary |
| C2 — Transparency | Visibility | Medium | Low | Medium — may be blocked by gag orders |
| C3 — Audit rights | Compliance verification | Medium | Low | Medium — retrospective, not preventive |
| C4 — Warrant canary | Gag order detection | Low-Medium | Low | High — indirect signal only |
| O1 — Access policies | Insider risk | Medium | Low | Medium — does not prevent compelled disclosure |
| O2 — Transparency reports | Accountability | Medium | Low | Medium — aggregate data only |
| O3 — ISO certification | Control assurance | Medium | Low | Medium — certification is point-in-time |