EU GDPR, BCR, CPC and other stuff

It is interesting to hear that Salesforce, one of the largest US cloud providers, has announced that its BCR (Binding Corporate Rules) have been accepted by the European Data Protection Authorities (WP29). See detailed text here.

The leading authority behind the acceptance was the French Commission Nationale de l'Informatique et des Libertés (CNIL), which was assisted by the Netherlands DPA and the Bavarian Landesamt für Datenschutzaufsicht. Link to the list of BCR accepted by the European Union here.

This development should be viewed in context with the end of the Safe Harbor Agreement caused by the Austrian law student Max Schrems (see "EU versus Facebook") in October 2015. “My personal guess is that the European BCR will not survive a similar kind of inspection by the European High Court” says Tobias Höllwarth, VP of EuroCloud. Höllwarth argues that no matter how well an individual agreement between two companies is worded, it will never overcome the core problem “that existing US law – related to the Patriot Act – shows fundamental differences to existing European law in some areas. Companies will not be able to overcome this issue – not even with BCR.”

This seems to be the uncomfortable truth for several thousand US cloud providers that store and process data for European customers. See information by the US House of Representatives here, the ongoing court case of Microsoft versus USA (the so called Ireland case) here, and a comment in the New York Law Journal here.

On the other hand, it is quite obvious that this would lead to a disastrous situation for European cloud customers who are willing to use cloud services delivered by providers outside the IT-Schengen area – a situation that nobody would wish to become reality.

Despite the surprising and clever agreement between Microsoft and Deutsche Telecom to use DT as a trustee for the Microsoft Azure and Office365 services (see here), it is clear that this cannot be a model for each and every cloud service provider outside the EU. “Neither will Deutsche Telekom be able to handle numerous cloud services, nor is this a model that is economically advantageous for the cloud customer, since he is forced to pay an additional charge for the trustee service,” says Höllwarth who argues: “I have the greatest respect for companies like Microsoft or Salesforce, that deliver service of high quality and do everything to comply with the complex situation of data privacy regulations in Europe, that vary from country to country. Most cloud providers do not have the necessary resources to handle such an unnecessary complex framework. It is this fragmented legal framework that we need to change.”

It is therefore interesting to know that there are more and more rumours indicating that the European Data Protection Directive might be approved by the Council of the European Union at the beginning of next year.
After the Commission’s draft in 2012 and the Albrecht Report (see EU/Albrecht Report), which was passed by the EU Parliament with 95% approval shortly after the Snowden case was revealed, we have now been waiting for more than 18 months for the Council to approve a hopefully not substantially modified text. See here an overview of the GDPR link

There is a very impressive independent movie (Link) currently running in selected cinemas that shows the development of this new law and the massive opposition by lobbyists against Mr. Jan Philipp Albrecht, a 33-year-old member of the European Parliament who acts as Vice Chair of the EU Committee on Civil Liberties, Justice and Home Affairs (see here). Mr. Albrecht was the official rapporteur of this new law to the EU parliament.

A pertinent multinational program called the Cloud Privacy Check (CPC) is also currently in its final phase of development.  45 lawyers from 32 countries are working on the project, whose final report as well as an online tool are expected to be published in 26 different languages at the end of January 2016. In the context of Safe Harbor, Binding Corporate Rules and the expected European Data Directive, the CPC will arrive at the perfect moment.

For the next 2-3 years, the CPC will serve as a guideline for cloud providers, customers and users alike. The CPC will help people to understand the generic value, concept and requirements of data protection regulations, and will make easy for them to handle the country-specific differences with confidence until unified – or at least similar and comparable – data protection regulations come into effect in all of these countries.

The Cloud Privacy Check (CPC) is intended to provide relief by employing three methodical approaches:

Simplification of a complex subject matter without loss in terms of content. The goal of the CPC is to elucidate the topic of data protection in the cloud to 90 percent on a single page, thus providing a comprehensible and workable basis of information for 90 percent of the people having to deal with the topic. But don’t worry: Jurists will still be needed.

Structuring of a plethora of questions into individual topical blocks which can then be approached step by step – from the simplest to the most complex case. Simultaneous correlation of the respectively required legal tools to be generated and evaluated in detail by jurists.

Separation of the generally applicable from the specific. This is probably the most significant aid for managing a complex trans-border endeavour. By identifying what is the same throughout all countries, the CPC allows the user to focus on the differences – if they actually apply to him. The CPC aims to provide access to relevant information affecting another country quickly and easily, without having to deal with those aspects that are the same as “at home”.