ABSTRACT
Since the CJEU Schrems II Judgment in July 2020, European data protection authorities (DPAs) in the EU have developed a ‘zero risk’ theory in relation to Chapter V of the GDPR. They have been asking data controllers that transfer data to ‘eliminate’ all risks of access to European personal data by the intelligence and law enforcement agencies of foreign countries whose legal systems do not include safeguards that are essentially equivalent to those mandated by EU law. As a result, many non-EU companies decided to localise data in Europe and propose so-called ‘sovereign’ solutions. However, this has often been deemed insufficient by DPAs who have highlighted the risk of extra-territorial access to data stored in Europe and have asked that any risk of such access by foreign authorities be ‘eliminated’ as well.
The legal actions by data protection authorities have been combined with political action by European governments. Several initiatives have been undertaken in this respect, including the ongoing discussions at the European Union Agency for Cybersecurity about the introduction of ‘sovereignty requirements’ into the EU Cybersecurity Certification Regime for Clo.ud Services (EUCS) …
Christakis, Theodore, The ‘Zero Risk’ Fallacy: International Data Transfers, Foreign Governments’ Access to Data and the Need for a Risk-Based Approach (February 20, 2024). CIPL/CBDF Paper Series.
Leave a Reply