CNIL Opens Consultation on Transfer Impact Assessment Guide

On January 8, 2024, the French Data Protection Authority (the “CNIL”) opened a consultation on its draft guidance for the use of transfer impact assessments (“Guidance”). In describing the Guidance, the CNIL references the decision of the Court of Justice of the European Union in Schrems II and states that exporters relying on tools listed in Article 46(2) and Article 46(3) of the EU General Data Protection Regulation (“GDPR”) for personal data transfers are required to assess the level of protection in the designated third country and the need to put in place additional safeguards (i.e., conduct a transfer impact assessment (“TIA”)). The Guidance is intended to assist data exporters in carrying out TIAs. 

The draft Guidance is a methodology that identifies various elements to be considered when conducting a TIA. It does not constitute an evaluation of the laws and practices of any third countries or any risks related thereto. The Guidance includes the following six steps:

1. Know your transfer.
2. Document the transfer tool used.
3. Evaluate the legislation and practices in the designated country of the data and the effectiveness of the transfer tool.
4. Identify and adopt supplementary measures.
5. Implement the supplementary measures and the necessary procedural steps.
6. Re-evaluate at appropriate intervals the level of data protection and monitor potential developments that may affect it.

The consultation will end on February 12, 2024. The CNIL will then review all submitted responses and intends to publish the final guidance in 2024.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts