Due to the introduction of home office during the Corona pandemic, the public administration was also forced to quickly implement video conferencing systems. This was criticized by many data protectionists, such as the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI). This criticism ultimately led to a legal dispute with the Free and Hanseatic City of Hamburg over the use of Zoom in Hamburg's administration.
The Hamburg Data Protection Authority announced on September 19, 2023, that the legal proceedings with the Senate Chancellery of the Free and Hanseatic City of Hamburg (FHH) have been settled by an agreement.
The most important points in brief
- Due to concerns regarding Zoom's data transmission to the USA, the HmbBfDI issued a warning to the State Chancellery in 2021.
- The Hamburg State Chancellery filed a lawsuit against the administrative measure.
- Due to the entry into force of the EU-US Data Privacy Framework in July 2023, the parties settled the proceedings.
- Zoom has not yet explained how it meets the certification criteria for the new adequacy decision.
Background
In August 2021, the HmbBfDI issued an official warning to the Senate Chancellery because they intended to use Zoom Inc. in Hamburg's administration.
In the opinion of the Hamburg Commissioner for Data Protection and Freedom of Information, the use of Zoom, as a US-based software company for video conferencing, involves the transfer of personal data to the USA, which does not provide adequate protection for this data.
Against the warning, the Senate Chancellery filed a lawsuit before the Administrative Court of Hamburg in September 2021.
Change in the legal situation through the adequacy decision
After the Schrems II ruling Following the ECJ's ruling in 2020 and the associated invalidation of the Privacy Shield, the legal basis for data transfers to the USA was overturned due to the fact that US intelligence agencies have extensive access to data stored by American companies, thus fundamentally enabling mass surveillance.
In the meantime, on July 10, 2023, the European Commission adopted a new adequacy decision („EU-U.S. Data Privacy Framework“) pursuant to Art. 45 para. 1 GDPR, which entered into force on the same day. Following these recent developments, the transfer of personal data to the United States is possible in a legally compliant manner if the responsible company has obtained a certification provided for by the adequacy decision.
Given this significant change in the legal situation, the supervisory authority and the Senate Chancellery agreed to settle the legal dispute amicably. In particular, there is no interest between the parties to have it judicially clarified whether the warning issued was appropriate under the legal circumstances at the time or not.
The EU-US Privacy Framework enables data transfers to certified companies
The adequacy decision by the European Commission, published in July 2023, currently serves as the basis for data transfers to the USA.
As the successor to „Privacy Shield,“ the adequacy decision attests to an adequate level of protection for the transfer of personal data to the USA. This establishes that personal data enjoys adequate protection in the USA comparable to European data protection law.
The central requirement is a certification of the data-receiving company, which is a self-commitment to comply with various data protection obligations. Exporters of personal data must first verify the certification of the recipient company in the USA.We reported here).
Is the use of Zoom compliant with data protection regulations now?
As a result, the question now arises whether the use of Zoom and similar services, and the associated transfer of personal data to the USA, is compliant with data protection regulations due to the new rules.
Formally, largely yes, because the EU-US Data Privacy Framework provides a basis for data transfer, and for this reason, data can currently be transferred to certified companies in the USA without any problems.
As long as the company is not certified, the data transfer must be accompanied by further protective measures (so-called appropriate safeguards).
Although Zoom does not have certification, the company refers in its Terms and Conditions on the continued existence of the European Commission's Standard Contractual Clauses, which generally also form the basis for international data transfers from the European Economic Area to non-EEA countries. Furthermore, the Hessian Data Protection Commissioner already approved a model for the use of Zoom in universities last year.
View
Only two months after the EU Commission issued the adequacy decision, in September French parliamentarian Philippe Latombe, a member of the centrist-liberal party Mouvement Démocrate, filed a lawsuit against it before the European Court of Justice.
The EU-US Data Privacy Framework was developed to establish a level of data protection that is „essentially equivalent“ to the GDPR, thus creating a new basis for data transfers to the US. Latombe, on the other hand, sees his rights as violated because, in his opinion, the Framework is neither in line with the GDPR nor with the EU Charter of Fundamental Rights. He is filing the lawsuit as a private individual and is seeking a temporary suspension of the Framework as well as a thorough review of the agreement.
The data protection organization NOYB, co-founded by data protection activist Max Schrems, had already announced on the day the adequacy decision was published that it would also take legal action against the renewed decision. Schrems had already successfully sued against the predecessor agreements, Safe Harbor and Privacy Shield.
Therefore, it can be assumed that the EU Commission's third attempt will also be subject to a review by the ECJ. While the outcome cannot be anticipated, it is advisable, in the best-case scenario, to continue to pay attention to supplementary protective measures for data processing that involves transfer to the USA. This applies particularly to Zoom, which has not yet certified itself for the application of the adequacy decision.
„>