The European Court of Justice (ECJ) ruled on July 16, 2020, that the EU-US Privacy Shield framework is not a valid transfer mechanism for personal data between the European Union and the United States, on the basis that US national security requirements do not meet EU privacy standards. In the same decision, the ECJ determined that the Standard Contractual Clauses remain a valid transfer mechanism.
We understand that the status of data transfers outside of the EU is changing quickly. As the Irish Data Protection Commission noted, the use of Standard Contractual Clauses “will require further and careful examination.” Lever is closely monitoring the changes in this area and is taking steps to make sure we are able to continue to serve our customers.
According to Data Protection Commissioner Andrea Jelink, the EDPB takes note of the duties for the competent supervisory authorities (SAs) to suspend or prohibit a transfer of data to a third country pursuant to SCCs, if, in the view of the competent SA and in the light of all the circumstances of that transfer, those clauses are not or cannot be complied with in that third country, and the protection of the data transferred cannot be ensured by other means, in particular where the controller or a processor has not already itself suspended or put an end to the transfer.
We have highlighted what this means for employers and Lever’s customers below.
Ongoing Legal Transfer Mechanisms
Based on the decision of the ECJ, Lever intends to rely on Standard Contractual Clauses with its customers and sub-processors for transfers outside of the European Union. For many customers, the move to Standard Contractual Clauses will not require any changes. Lever has included Standard Contractual Clauses in our online Terms of Service along with our Data Protection Agreement last year as of September 1, 2019. For those customers who do not have Standard Contractual Clauses in place, we have added a pre-signed set of Standard Contractual Clauses to our Privacy Center, which can be signed by each customer and returned to Lever.
New Organizational Changes
To support Lever’s growing customer base, Lever opened an office in Canada (which is considered an adequate country for data transfers from the EU) in 2019. We have also opened a EU data center in Germany to support our international customer base.
Planning for the Future
As the legal landscape for data transfers between the EU and US continue to shift, we plan to continue to expand our operations to support international customers. Lever is currently planning to expand its international presence and extend the international infrastructure options for our customers. We will continue to monitor the progress of the European Data Protection Board, which has promised updates to the Standard Contractual Clauses and further analysis of the ECJ decision, to direct the way we support our customers.
To learn more about Lever’s commitment to privacy, click here.