Data Protection Commission stops data transfer to USA

The Portuguese National Data Protection Commission, the Comissão Nacional de Proteção de Dados (CNPD), has ordered the Portuguese Office of Statistics , the Instituto Nacional de Estatística (INE), to stop the transfer of census data to the USA or any other third country without adequate data protection.

According to its own press release, the CNPD had received several complaints about the conditions of the data collection through the internet. Conducting an accelerated investigation, the CNPD found out that INE used a Californian company, Cloudflare, Inc., for the operationalisation of the census survey, which, by contract, provided for a transfer of personal data to the USA. The Californian company is directly subject to the US national security surveillance legislation and, therefore, under the legal obligation to give US authorities unrestricted access to the personal data which it holds without the possibility to inform its clients about such access.

With a view to the European Court of Justice’s Schrems II decision of July 2020 and the finding by the Court that such legislation interferes with the fundamental rights of data subjects under EU law and, as a consequence, does not ensure a level of data protection that is essentially equivalent to the guarantees existing in the European Union, the CNPD saw itself obliged to take action in this case in which standard contractual terms were used without guarantees existing that these would be respected in the third country.

Against this background and with a specific view to the high number of data subjects affected as well as to the fact that special categories of data within the meaning of article 9 GDPR, such as data on health or religion, were affected, the CNPD did not see any alternative but to order the suspension of any data transfer to the US or any other non-adequate jurisdiction within 12 hours.

It is yet unclear whether other data protection authorities in Europe will take similar steps in comparable cases, but it appears clear that the aspects taken into account by the Portuguese authority – a high-volume transfer, including special categories of data, to a recipient which is directly subject to surveillance legislation – will suggest themselves as key aspects for any data transfer from the EU to third countries.