"Adequate level of data protection"
Extracted from the public Notion original. Notion record created 2019-09-30. Last edited 2019-09-30.
Thinking in GDPR includes the need to understand how the legislation extends its reach into other jurisdictions. One good example is the need to think in terms of "data export" and the European Commission's power to determine if a country has an adequate level of data protection.
See details here of which countries have been determined to have an adequate level of data protection:
The list (as at Oct 2019) of countries is:
- Andorra
- Argentina
- Canada (commercial organisations)
- Faroe Islands
- Guernsey
- Israel
- Isle of Man
- Japan
- Jersey
- New Zealand
- Switzerland
- Uruguay
- United States of America (limited to the Privacy Shield framework)
- Japan (recent)
It is possible to transfer data to a country that doesn't have the designation of having "adequate data protection", but you have to take on the burden of making the whole exchange GDPR-like, see:
The European Union general data protection regulation: what it is and what it means
Quote:
First, the European Commission can evaluate other countries’ legal regimes and find them adequate.147147 GDPR art 45.View all notes The Commission has approved only eleven jurisdictions: Andorra, Argentina, Canada, Faeroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, and Uruguay.148148 European Commission, ‘Data Transfers Outside the EU’ <https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_en>.View all notes Such approval is normally only given after long negotiations, in which the country in question updates its national data protection regime to a level that is nearly as protective as the EU-data protection rules.
Second, when the data are transferred to an organization that is based in a non-EU country for which there is no adequacy decision, this will only be deemed legitimate when the organization in question contractually guarantees that it will uphold, within its organization, a level of data protection that is similar to the GDPR, including all of the material and procedural safeguards. Consequently, the data transferred to an organization in a non-EU country will still be under a similar level of protection as when they would have stayed on EU-territory.149149 GDPR arts 46–47.View all notes
Contractual guarantees
To ensure data is protected outside of both EU countries, and outside of countries the European Commission has deemed as having "adequate data protection" the obligation to put into contracts the same level of GDPR-like protection arrises.
This is where "data protection agreements" come from and why they are critical to compliance.
India's Personal Data Protection Bill
Isn't yet passed - but modelled after GDPR:
Personal Data Protection Bill only after new government takes over
Comparison here: