Norway's Data Protection Authority, Datatilsynet Norway, issued a Q&A on cross-border transfers in the wake of the Schrems II ruling

Key Takeaways

• Access to European Union data from a third country constitutes a transfer.
• In addition to complying with all relevant requirements of the General Data Protection Regulation, such as the rules on the basis of processing, data processor agreements and risk assessments, you must do the following:

1. Ensure that you have in place an appropriate transfer mechanism from among those set forth in Article 46 GDPR.
2. Ensure that the level of protection that will be achieved in practice is in fact equivalent to that in the European Economic Area, all factors being taken into account. Therefore, carefully examine whether there are circumstances that mean that the level of protection that the transfer basis is intended to ensure will not be realized in practice.
3. If you come to the conclusion that there are circumstances that mean that the level of protection will not be equivalent to that in the EEA, you must implement further measures that compensate for this and that ensure a similar level of protection in practice

• What the additional measures may entail must be decided in each individual case, in light of the specific circumstances. There could potentially be talk of legal, technical or organizational measures. At present, however, there is great uncertainty about what kind of additional measures may be sufficient if the third country has laws that take precedence over the obligations
• It is important to wait to enter into new agreements with third country suppliers until you are absolutely sure that you are fully able to comply with all of the European Court of Justice's additional terms. If in doubt, the agreements should not be entered into. One must be prepared for the fact that new agreements involving the illegal transfer of personal data to third countries may be considered more severely than existing agreements. The old agreements were entered into before we became aware of the European Court of Justice's additional terms, and in the first months after the ruling, it may take some time to adjust to the new rules. New, illegal agreements, on the other hand, can be seen as a violation committed against better knowledge from the outset, and there is no excuse for having entered into such agreements.
• You are responsible for selecting only data processors that can provide adequate assurance that they will comply with our privacy policy. This also means that the data processor must be able to give you a clear and written answer as to whether it is subject to surveillance laws in a third country, and if so, which ones. For example, a U.S. data processor may be subject to the FISA 702 or CLOUD Act, even if the data is only stored in European data centers.