CNIL launches a public consultation on Transfer Impact Assessment Guide
12 February 2024
On the 8th of January 2024, the Commission Nationale Informatique et Libertés ("CNIL"), the French Data Protection Agency, launched a public consultation on its draft guide ("Guide") concerning Transfer Impact Assessments ("TIAs") for personal data transfers outside the European Economic Area.
Referring to the Court of Justice of the European Union's ruling in Schrems II on upholding EU data protection standards for data transfers, the CNIL asserts that exporters using tools outlined in Articles 46.2 and 46.3 of the EU General Data Protection Regulation ("GDPR") are obliged to assess the data's protection level in the designated third country and implement additional safeguards (i.e., conduct a TIA).
The Guide aims to assist data exporters in conducting TIAs and thus outlines the following six-step approach for consideration:
1. Identify and understand the data being transferred
2. Document the transfer tool employed
3. Assess the legislation and practices in the receiving country, along with the transfer tool's effectiveness
4. Identify and adopt supplementary measures (such as technical, contractual or organisational measures)
5. Implement the measures and necessary procedural steps
6. Periodically reassess data protection levels and monitor potential influencing developments.
It is important to note that while the Guide offers a checklist and insights into TIA procedures, compliance with its recommendations is not mandatory. Indeed, additional elements can be taken into consideration when undertaking TIAs. Furthermore, the Guide does not encompass an evaluation of laws and practices in third-country destinations, or their associated risks.
The public consultation is scheduled to conclude on the 12th of February 2024. The CNIL will subsequently assess all public consultation responses before publishing the final guidance on its website in 2024.
Authors: Nicolas Quoy, Partner; Antoine Boullet, Senior Associate; Muriel McCracken, Trainee Solicitor.
