Data Embassy Principles For Data Protection

On July 16th, the Court of Justice of the European Union (CJEU) invalidated the EU-US Privacy Shield for lawful transfers of EU personal data to the US. Companies must now find lawful solutions embodying "supplemental measures" like those exemplified by Data Embassy Principles.

Data Embassy Principles maximise lawful and ethical secondary data processing, like analytics, AI and ML using EU personal data, by technically enforcing established EU data protection principles to satisfy new requirements recently established by the Court of Justice of the European Union (CJEU) in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (Case C-311/18), “Schrems II.”

Data Embassy Principles comprise:

GDPR Pseudonymisation: Enforcing GDPR-compliant pseudonymisation as per ENISA guidelines. This is in accordance with the new standard set by GDPR Article 4(5) requirements that technically enforce WP29 and EDPS recommendations for Functional Separation. Note that the effectiveness of these protections can be appealed by data subjects to an EU supervisory authority, ensuring the availability of effective judicial remedy under Article 47 of the EU Charter.
Data Minimisation: Enabling Data Minimisation compliant with GDPR Article 5(1)(c) by enforcing Article 25(1) and 25(2) Data Protection by Design and by Default techniques using GDPR-compliant pseudonymisation.
Secured Personal Data: Restricting processing to a form of personal data that does not enable the identification of data subjects as provided under GDPR Articles 11(2) and 12(2) by keeping the “additional information” needed for relinking in the sole possession of the EU-based data exporter. This activates significant and far-reaching changes in a data controller’s obligations that greatly facilitate “compliance with the level of protection essentially equivalent to that guaranteed within the EU by the GDPR."
Demonstrability: Proactive technical enforcement enables data controllers to demonstrate compliance with their accountability and demonstrability obligations under GDPR Article 5(2).
Responsibility: Technical and organisational measures enable data controllers to demonstrate compliance with their accountability and responsibility obligations under GDPR Article 24.

References

As a complement to longer-term development of a political resolution to the international challenges underlying the invalidation of the EU-U.S. Privacy Shield under Schrems II,^{^[1]} this Memorandum proposes using “Data Embassy Principles” (as described herein) to enforce EU data protection obligations.

^{^[1]} Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (Case C-311/18), “Schrems II”). See http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=9745404

This article "Data Embassy Principles For Data Protection" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Data Embassy Principles For Data Protection. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.