Drafting Agreements With Vendors and Other Data Recipients: Complying With U.S. State Consumer Privacy and GDPR Requirements

Description

The past few years have seen an updating of the GDPR’s “Standard Contractual Clauses” (SCCs) and an agreement for an alternative EU to US personal data transfer adequacy mechanism, the EU-US Data Protection Framework (“DPF”), versions of which have also been adopted by the UK and Switzerland. During this time GDPR inspired the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively “CCPA”), and it in turn inspired nineteen other US states to pass consumer privacy laws. However, the US laws differ materially from GDPR as well as each other, making global compliance challenging. The US has also taken a different direction than the Europeans on personal data exports. In February 2024, President Biden issued Executive Order 14117 Preventing Access to American’s Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern (“EO”), further to which the Department of Justice on October 21, 2024, issued proposed regulations. On the heels of the EO, and at urging of the President, in April 2024, Congress passed the Protecting Americans’ Data from Foreign Adversaries Act (“PADFA”) as well as the so-called Tik Tok ban – the Protecting Americans from Foreign Adversary Controlled Applications Act.

Adoption of the DPF and updating of the SCCs have gone some way towards addressing the concerns of EU data protection authorities, even if not those of privacy campaigners such as Max Schrems. However, barriers remain from a European and UK perspective. Transfers made directly to US participants in DPF benefit from the “adequacy decision”, but further compliance steps are required if there is an onward transfer of that data, whether within the USA or to a third country. Where DPF is not available, European data exporters must determine whether GDPR applies to the US data importer and, if so, find a way to overcome the difficulty that the existing SCCs cannot be relied upon in those circumstances. The EU Commission is consulting on an additional set of SCCs to fill that gap, but for the moment it remains necessary to take a risk-based approach.

This webinar will compare and contrast the European and American approaches to the processing and transfer of personal data, as well as best practices for data processing and transfer arrangement due diligence and terms and conditions and how to streamline the procurement and contracting process.

Listen as our authoritative panel of attorneys clarifies the CPRA requirements and best practices to modify policies to ensure compliance.