DLAPvc20130813

Contents

Follow-up VC on the non-EU/EEA Data protection Code of Conduct

Went through the questions that the DLA Piper memo by DLA Piper 29 Jul 2013 had risen:

in principle, other legal bases could be used. In practice it is cumbersome
consent legal grounds
- Home Organisation needs to be able to demonstrate that consent has been given by the user
- consent, if used, isn’t necessarily freely given
“Performance of contract with End User” and “Performance of contract concluded in the interest of the End User”
- in some cases it could be used (e.g. contract of employment), but universities likely to have also affiliated users without a contract, and then you needed something else for them
therefore, standard contractual clauses is a catch-all that covers all scenarios
- standard contractual clauses is also a well-know and widely used approach
- DLA Piper is seeing also double approaches where, to be in the safe side, both contractual clauses and consent are used simultaneously
there could be also an alternative plan, where consent is used as a fall-back for those SPs who don’t want to sign the Contractual Clauses.

Contractual Clauses document, IV – applicable law: “…the law of the country in which the data exporter is established”.
in our case there will be parallel data exporters in several countries. A question arises, if this causes problems or confusion about the applicable law
we cannot change this section because it follows from the standard contractual clauses
If there is a problem you need to find which is the home organization in question
- if it is a Spanish home organization then the Spanish laws are applied
- In the worst case there are several parallel lawsuits in several EU countries where even the laws are a bit different.
in the long run, the general data protection regulation may fix the problem of fragmented laws

legally speaking the approach is global. No matter in which country/jurisdiction the SP is established, the contractual clauses obligates it to the EU laws
strategically it makes sense that the home organization decides if the non-EU CoC is sufficient for SPs in some countries where it is difficult to make business
- it depends on the culture and legal regime of the country
- it may be difficult to draw up a list of those countries. Luckily, each home organization may have a separate list
for the technical implementation, we may need to consider a SAML metadata tag indicating the SP’s jurisdiction
- to enable automated filtering of the SAML metadata
conflicts with SP’s local laws
- Patrick doesn’t think it is likely that the CoC conflicts with the SP’s local data protection laws
- instead, it is possible that the CoC conflicts with other local laws, such as the US terrorist laws that obligate the SP to release personal data to authorities

Charter Adherence Form – are ink-signatures needed or can we use electronic ones (like we did in the EU/EEA-CoC)?
- Patrick thinks ink-signatures are not necessary. There is no statutory requirement of a signature
- you need to be able to convince a judge that the SP has indeed approved the CoC. Secure logfiles, timestamps issued by TTP etc
- you need to be able to prove that on day X the Home organization or SP was committed to the CoC, and the transaction has taken place after that
- Patrick thinks that for simplicity we could use similar approach as we did in the EU/EEA-CoC
electronic signature in non-EU CoC
- it doesn’t matter that non-EU countries don’t have an e-signature directive.
- this kind of agreement can be only disputed in EU, because it is relevant for EU data protection.
- e.g. if an African SP commits to the CoC and then disputes the commitment, it will be a European judge who decides if the dispute is credible
this proposes we could use the same mechanisms relying on SAML2 metadata exchange that we used in the EU-CoC

The current memo proposes some roles to GÉANT: gather adherence documents; publish a list of parties committed to the charter.
If we use the same approach we use in the EU-CoC we don’t need to give any extra responsibilities to GÉANT
- in addition to the reliable SAML2 metadata exchange
It would also enable the CoC being used outside the GÉANT community
- federations or institutions bilaterally, REEP etc