On July 16, 2020, the Court of Justice of the European Union (“CJEU”) handed down its much-awaited decision in what has become known as the “Schrems II” case and invalidated the EU-U.S. Privacy Shield Framework maintained by the U.S. Department of Commerce (“Privacy Shield”).
The ruling will have little practical impact on Adaptive Insights customers. While companies may no longer use Privacy Shield as a data transfer mechanism for personal data from the European Economic Area to the United States, Adaptive Insights employs other valid data transfer mechanisms not affected by today’s ruling. And as a privacy leader, we will continue to evolve and offer new data transfer mechanisms to customers as they become available.
Which other European data transfer mechanisms does Adaptive Insights offer?
Adaptive Insights does not rely on a single data transfer mechanism, but offers our customers a number of options to legalize transfers of personal data from the European Economic Area to the United States.
Besides our Privacy Shield certification, we also offer the European Commission’s controller-to-processor Standard Contractual Clauses (Commission Decision 2010/87/EU) which the CJEU has ruled remain a valid lawful data transfer mechanism for personal data exports.
Does the invalidation of the Privacy Shield impact customers’ European data transfers to Adaptive Insights?
No. Today, the majority of our European customers and many global customers already rely on the Standard Contractual Clauses to transfer their data so that an invalidation of the Privacy Shield does not have a direct impact on their data transfers to Adaptive Insights in the U.S.
For those customers who have not yet executed the Standard Contractual Clauses, Adaptive Insights has made available a pre-signed, electronic amendment to incorporate the Standard Contractual Clauses into their existing data processing terms. Details on how to execute the amendment are provided below.
Does the invalidation of the Privacy Shield impact customers’ Swiss data transfers to Adaptive Insights?
While the ruling does not directly affect Switzerland, the Swiss data protection authority reassessed the conformity of the Swiss-US Privacy Shield Framework following the CJEU's decision and found that it does not provide an adequate level of protection for data transfer from Switzerland to the US pursuant to the Swiss data protection act.
Can we still use the Standard Contractual Clauses to transfer personal data to Adaptive Insights?
Yes. Adaptive Insights is taking compliance and the protection of European personal data very seriously. The CJEU’s decision on the Privacy Shield does not prevent the use of the Standard Contractual Clauses as a lawful data transfer mechanism, meaning that they can still be relied upon to transfer data to Adaptive Insights.
We will assess the impact of this decision on the Standard Contractual Clauses in the coming days to better understand its effects and to provide further support to our customers.
How can we incorporate the Standard Contractual Clauses into our data processing terms with Adaptive Insights?
Please click here to review and execute Adaptive Insights’ Standard Contractual Clauses Amendment.
If someone else in your organization needs to sign the Amendment, please copy and forward the link to the authorized signatory.
After electronically signing the amendment, the signer will receive an identity verification email from Adobe® Sign. The signer must click on the verification link in the email for the signed amendment to be forwarded to Adaptive Insights. The amendment is not binding until the verification step is complete and Adaptive Insights validates receipt of the amendment. Upon validation, all parties will receive a signed copy.
Will Adaptive Insights consider offering newly available transfer mechanisms?
Adaptive Insights is continually evaluating new transfer mechanisms as they become available. The European Commission has repeatedly demonstrated that it is very committed to data transfer contracts as a means to facilitate transfers of personal data and has recently announced that it is working on modernizing the Standard Contractual Clauses. These updated clauses could potentially resolve any deficiencies found by the CJEU. Once the European Commission publishes the updated clauses, Adaptive Insights will review and evaluate whether they can be made available to our customers as a transfer mechanism.
What is Adaptive Insights’ position on the free flow of data between countries?
The free flow of data across borders—including data transfers from Europe to the U.S—is critical to individual businesses and the greater economy. We meet regularly with officials on both sides of the Atlantic to talk about the economic importance of data transfers and the benefits they provide for cloud computing.
We will continue to promote the free flow of data through our work with both the European Commission and the United States government.
The most important thing to know is that Workday will continue to put our customers, including their data, privacy, and related processes, first.
How can I contact Adaptive Insights if I have questions?
We realize the topic of cross-border data flows are complex ones to tackle, but we’re here to help. If you have any questions about your cross border data transfer mechanisms with Adaptive Insights, please contact firstname.lastname@example.org.