Digital sovereignty and data transfers
Who has authority over data: laws with extraterritorial reach, transfers outside the Union under the GDPR, the Schrems rulings, the 2023 framework with the United States and European answers such as SecNumCloud.
- 24 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the timeline
- Scenarios
A few cards from the deck
Data sovereignty: what is it?
Show the answer
The ability of a state or organisation to keep its data under its sole control and under the law it has chosen, out of reach of a foreign law.
The server's location is not enough to ensure it: what matters is the law that applies to whoever controls the data.
A French company outsources its payroll to a provider based in India, a country with no adequacy decision. What must it provide?
- Safeguards, such as standard clauses, after reviewing local law
- Nothing beyond an ordinary processing contract with the Indian provider
- Simply informing employees that the transfer of their data takes place
- A prior declaration to the CNIL, which counts as authorisation of the transfer to India
Show the answer
Safeguards, such as standard clauses, after reviewing local law
Without adequacy, a Chapter V basis is needed: appropriate safeguards (standard clauses, binding corporate rules) or, for an occasional case, a derogation. Informing employees is owed but legitimises nothing.
Without an adequacy decision, a transfer may rely on … or, within a group, on ….
Show the answer
Without an adequacy decision, a transfer may rely on standard contractual clauses or, within a group, on binding corporate rules.
These are the two most common appropriate safeguards. Derogations (explicit consent, contract necessity) are only for occasional cases.
Transfer outside the Union: what is it?
Show the answer
Sending or making personal data available to a recipient in a country outside the European Economic Area; Chapter V of the GDPR governs it.
Even remote access from a third country, for instance for technical support, already counts as a transfer.
Health data is hosted in Paris by the subsidiary of a US group. What is the risk, and what safeguard?
- US law follows the company, not the place; a SecNumCloud-qualified offer or encryption with the customer's keys
- No risk, since the server is in Paris: only French law applies there
- An unlawful transfer for lack of adequacy; signing standard contractual clauses is enough
- The GDPR bans any host belonging to a foreign group; the subsidiary must be replaced
Show the answer
US law follows the company, not the place; a SecNumCloud-qualified offer or encryption with the customer's keys
Control by a US parent exposes the data to a Cloud Act request despite the location. SecNumCloud or encryption with the customer's keys reduce that risk; standard clauses settle nothing, since there is no Chapter V transfer.