Data and cyber

Horizon scanning

New data transfer clauses under consideration, but is it too late for Uber in light of €290m fine?

What is happening?
On 12 September 2024, the European Commission announced its intention to launch a public consultation on a new type of Standard Contractual Clauses (SCCs) for the export of personal data. The use of SCCs is one way that organisations can protect personal data that is subject to data protection laws in the EU, including the EU General Data Protection Regulation (EU GDPR), when it is transferred outside the EEA to countries that the European Commission does not consider to provide an equivalent level of protection for that data.

In particular, the amended SCCs now under consideration (the New SCCs) will apply to international data transfers where both the data exporter and the data importer are subject to the EU GDPR.

As it stands, this is a gap in the approved contractual clauses where organisations subject to the EU GDPR export personal data from the EU, but where the data importer is also subject to the EU GDPR. As the current SCCs cannot be used for this purpose, this has created some uncertainty around the safeguards businesses should use for this type of data transfer.

The introduction of New SCCs for this purpose is timely, coming in the wake of the recent decision by the Netherlands Data Protection Authority (the Dutch DPA) to fine Uber €290m for its failure to adequately protect the personal data of its European drivers when transferring this data to its parent company's servers in the US. Uber had not used the existing SCCs for this purpose, arguing that its US parent is also subject to the EU GDPR. As there are currently no valid SCCs for a transfer of this kind, Uber claimed that this could not be used as a transfer mechanism.

Why does it matter?

The current EU SCCs
By way of background, the European Commission's approved SCCs, which were adopted on 27 June 2021, are a template set of terms and conditions that can be incorporated into contractual arrangements to enable compliance with international data transfer requirements under EU law. This is one of the safeguards that organisations can implement to ensure that appropriate data protection standards are adhered to when transferring personal data internationally to a third country outside of the European Economic Area.

The EU SCCs currently consist of four modules, which are to be applied depending on the processing relationship in question. For example, Module one relates to controller-to-controller data transfers while Module two is applicable to controller-to-processor data

transfers. The current EU SCCs also form the basis of one option for safeguarding personal data when it is exported from the UK, in the form of an Addendum that can be scheduled to the EU SCCs.

The European Commission's consultation on the New SCCs comes in the wake of calls to address a gap in the current SCCs. Namely, the current SCCs do not cover the scenario where both the data exporter and the data importer are subject to the EU GDPR. In their current form, they only deal with the transfer of data to third country controllers and processors that are not subject to the EU GDPR. This may also affect organisations that transfer personal data between operations inside and outside the EU, as was the case for Uber.

Uber's fine from the Dutch DPA
This gap was central to the Dutch DPA's July 2024 decision in relation to Uber's data transfer mechanisms between its EU and US entities. For a two-year period between 2021 and 2023, the data sharing agreement between Uber's European lead company in the Netherlands and its group company in the US (which were joint controllers of driver data, and both subject to the EU GDPR) did not include any SCCs. Uber argued that SCCs were not required as its US entity was already subject to the EU GDPR as joint controller, and the SCCs were not drafted to apply to this situation. Uber has expressed its intention to appeal the Dutch DPA's ruling.

This case has further exposed a practical issue with the current SCCs, which the Commission has sought to address with the announcement of the public consultation. Additionally, the DPA's decision shows that European regulators are willing and able to investigate complaints from data subjects regarding international data transfers and, where necessary, impose substantial financial penalties in the event of a breach.

What could happen next?
As drafts of the New SCCs have not yet been published, it remains to be seen what obligations they will impose on data exporters and importers. These will also be subject to change following the outcome of the consultation.

While the consultation is ongoing, organisations subject to the EU GDPR who are engaged in transferring personal data outside of the EU should review their data transfer arrangements with the Uber ruling in mind and, if appropriate, seek advice on whether SCCs should be included.

In anticipation of the publication of the New SCCs, international organisations with operations in the EU may wish to perform a data mapping exercise to determine if their non-EU companies are subject to the EU GDPR.

Key dates

The public consultation is planned for the fourth quarter of 2024, and it is anticipated that the New SCCs will be adopted by the Commission in the second quarter of 2025. Uber's appeal is also likely to be heard in the coming months.

Jon Bartley
Partner
+44 7912 242142
jon.bartley@rpclegal.com

Amy Blackburn
Senior Associate
+44 7749 402026
amy.blackburn@rpclegal.com

Dom Barnes
Trainee Solicitor
+44 7523 678987
dom.barnes@rpclegal.com

Recent developments

What do CISOs, the UK government and EU regulators all have in common?

What is happening?
There have been a number of large scale and high-profile supply chain cyber attacks in recent years. These have brought the potentially far-reaching consequences of supply chain incidents up agendas. For example, MOVEit, a file transfer company, brought hundreds of organisations worldwide within the sphere of an incident according to Reuters. More recently, the widely felt Crowdstrike outage affected not just their direct customers, but a large number of third-party organisations which were reliant on those customers as well; this in turn had knock-on effects to the extended supply chain.

Whilst these highly publicised examples of supply chain incidents are fairly infrequent, RPC's own experience with advising on cyber incidents and data breaches day-to-day has involved acting on an increasing number of incidents which have some supply chain impact.

This can be difficult for organisations to protect against because even if an organisation has adequate security standards and is not subject to a cyber incident directly, they can still be affected by security issues that exist elsewhere in the supply chain; and it also creates potential notification obligations and litigation implications relating to an incident of which the organisation has incomplete knowledge and control.

This rise in, and importance of, supply chain incidents has been acknowledged at organisational, national and international level, with chief information security officers (CISOs), the UK government, and EU regulators all focusing in on supply chain incidents.

Why does it matter?
The National Cyber Security Centre works closely with organisations to increase operational resilience across the UK and have advised in a recent talk that CISOs are increasingly concerned with supply chain

incidents. CISOs are taking more of an interest in supplier obligations around cyber security and data protection, and taking measures to ensure that appropriate clauses are not just being written into supplier contracts, but also subsequently being enforced.

The Cyber Security and Resilience Bill, which will be introduced to Parliament in 2025 with the aim of strengthening the UK's cyber defences, is also concerned with supply chain incidents. Whilst the specific wording of the Bill has not yet been released, the UK government has recognised that supply chains are "an increasingly attractive threat vector for attackers" and advised that one of the crucial updates in the Bill will be to expand the remit of the legacy regulatory framework to protect supply chains.

In the EU, the Digital Operational Resilience Act (DORA) and the NIS2 Directive also introduces a risk management framework which will affect supply chains in key areas of infrastructure.

DORA will apply from 17 January 2025 and aims to shield financial institutions from the increasing prevalence of cyber attacks with a particular focus on how financial entities manage ICT third party risk. DORA's provisions include requirements to adopt and regularly review a strategy on third party risk, to implement standards for ICT third party service providers, and various steps to be taken before entering into ICT service contracts.

The NIS2 Directive requires that Members States adopt policies that address cybersecurity in the supply chain (Article 7(2)(a)) and requires in scope entities to include supply chain security as a key factor when implementing measures to protect network and information systems from incidents (Article 21(2)(d)).

What actions should you take?
The increasing risk of falling victim to a supply chain incident, coupled with the plethora of regulatory requirements around this aspect, means that organisations will increasingly need to look beyond just their own technical environments when considering cybersecurity.

Even organisations that are not caught by new regulations should also take steps to reduce the risk of being impacted by the fallout of a cyber breach suffered by a third-party supplier.

These include, for example:

conducting due diligence when looking to partner with a supplier
ensuring contracts include obligations to maintain appropriate security measures and provide information in the event of a breach
actively thinking about what steps would be taken in the event of a supply chain breach occurring using written breach readiness plans.

“The increasing risk of falling victim to a supply chain incident, coupled with the plethora of regulatory requirements around this aspect, means that organisations will increasingly need to look beyond just their own technical environments when considering cybersecurity.”

Richard Breavington
Partner
+44 7748 366441
richard.breavington@rpclegal.com

Elizabeth Zang
Associate
+44 7851 243222
elizabeth.zang@rpclegal.com

Recent developments

ICO takes action against Sky Betting and Gaming for using non-essential cookies without users' consent

What is happening?
In September 2024, Bonne Terre Limited, trading as Sky Betting and Gaming (Sky Betting) was reprimanded by the UK's data protection regulator, the Information Commissioner's Office (ICO), over the unlawful use of advertising cookies on its website.

Visitors to the online gambling website were informed via a pop-up banner they could "Accept All Cookies", however, following an investigation into Sky Betting's activities, the ICO found that some advertising cookies were placed, and personal data transferred to third parties, as soon as website visitors accessed the site, without their knowledge and before they could choose to either accept or decline the use of these cookies. The ICO issued the reprimand on the basis of infringements of Article 5(1)(a) (lawful, fair and transparent processing), Article 6(1)(a) (consent) and Article 7(1) (controller to demonstrate consent).

Further to being notified by the ICO of their infringement of the law, Sky Betting promptly changed its processes so that no direct advertising cookies are set without user consent.

Why does it matter?

The reprimand highlights the ICO's focus on the unlawful use of cookies, particularly those used for targeted advertising. It can be viewed in the context of the ICO's ongoing investigation into the compliance with cookie consent rules by the UK's top 100 websites (based on "active time spent by UK users"). 53 of those websites were identified as being non-compliant and, following warnings by the ICO of potential enforcement action, either fixed the infringing issue or took steps to resolve it. The ICO has said it is planning to review the next 100 websites, "and the 100 after that", on the same basis.

Conclusion

The reprimand to Sky Betting evidences the importance of ensuring that individuals have genuine choice over cookies and similar technologies. This is brought into sharp focus by the regulator's increased monitoring of compliance with the rules on cookies and the use of personal data derived from them.

Jon Bartley
Partner
+44 7912 242142
jon.bartley@rpclegal.com

Helen Yost
Senior Associate
+44 7761 279646
helen.yost@rpclegal.com

Mia Pullara
Trainee Solicitor
+44 7523 678940
mia.pullara@rpclegal.com