Safeguarding data flows - a joint statement from leading European associations on the EDPB “supplementary measures” recommendations

21 December 2020

Orgalim together with 17 other Europe...

Orgalim together with 17 other European associations has written a letter to the European Data Protection Board (EDPB) calling for a review of its approach following the recently released (draft) recommendations on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data.

We believe the current draft will make Europe’s ability to operate within the global economy unreasonably impractical.

Europe depends on data flows: whether for consumers buying products or services through their bank accounts, medical research or suppliers collaborating to overcome a health crisis, paymasters remunerating employees, agricultural traders supporting the food supply chain, travellers booking a flight or a hotel, matching job seekers to a job, manufacturers adding worth to industrial value chains, an SME launching a marketing campaign for a new brand, insurers outsourcing customer claims management or the analysis of statistics to support public services. Even simple tasks such as sending an email rely on data flows.

While a challenging task, the EDPB’s current approach to data flows threatens Europe’s bid to become “fit for the digital age” to the detriment of strengthening Europe’s data economy, maintaining trust in digital services, ensuring high cybersecurity capacities and leading in Artificial Intelligence (AI).

We encourage:
• Following a risk-based approach that takes the full context of data transfers into account;
• The possibility to continue relying on contractual and organisational measures;
• Developing workable technical solutions (rather than overreliance on encryption).

The undersigned associations therefore call for the EDPB to rethink its approach in order to better align with the GDPR, recent CJEU jurisprudence and the Commission’s (draft) Standard Contractual Clauses in order to safeguard Europe’s data flows in a more pragmatic manner.