Cloudflare : Portugal Puts Halt On Data Transfers Between INE And Cloudflare
May 12, 2021 at 10:10 am EDT
Share
The Portuguese data protection authority issued a recent resolution ordering the Portuguese National Institute of Statistics (or INE) to stop sending personal census information to any countries outside of the EU that do not provide "adequate" levels of data protection. Among those countries are the United States.
Prompting the resolution was the INE's use of the US company Cloudflare, Inc. The parties had standard contractual clauses in place, and relying on those, the INE transferred Portuguese resident data from the 2021 census surveys to Cloudflare. Citing the Schrems II decision, the Portuguese data protection authority (CNPD) concluded that the SCCs were not sufficient, since Cloudflare is subject to US surveillance laws, which could require the company to share personal information with US authorities.
Noting that as a data protection authority, it was required to stop data transfers if there were insufficient guarantees that the transferred information was protected, the CNPD made the decision to order the data transfers to be stopped. The parties had only 12 hours to comply.
Putting it Into Practice: This resolution, which comes just a month after a similar decision from Bavarian authorities, signals that EU data protection authorities are watching data transfers to the US closely. While we await updated SCCs, recommendations from the EDPB about data transfers can be helpful.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
Ms Liisa Thomas
Sheppard Mullin Richter & Hampton
333 Hope Street, 48th Floor
Los Angeles
California
90071
UNITED STATES
Fax: 2136201398
E-mail: mbennett@sheppardmullin.com
URL: www.sheppardmullin.com
Cloudflare, Inc. is a connectivity cloud company. The Company is a global cloud services provider that delivers a range of services to businesses of all sizes and in all geographies. Its network serves as a scalable, unified control plane to deliver security, performance, and reliability across on-premise, hybrid, cloud, and software-as-a-service applications. Its integrated suite of products consists of solutions for an organization's external-facing infrastructure, such as Websites, applications, and application programming interfaces to deliver security and reliability; solutions to serve an organization's internal resources, such as internal networks and devices; developer-based solutions, and consumer offerings. Its security products include Web Application Firewall, Bot Management, SSL/TLS Encryption, and Secure Origin Connection. Its performance products include Content Delivery, Intelligent Routing, Content Optimization, and Others. It is also focused on multicloud networking.