Court of Justice of the European Union (CJEU) – Violation Found (European Union, 2023)

The Court of Justice of the European Union (CJEU) had concluded a contract with Cisco International Limited UK (Cisco UK) for the use of the videoconferencing solution 'Cisco Webex' and related services (the contract). Certain annexes of the contract were concluded with Cisco Systems Inc. In August 2021, the EDPS temporarily authorised the use of contractual clauses between the CJEU and Cisco Systems Inc. for transfers of personal data in the CJEU’s use of Cisco Webex and related services ([https://edps.europa.eu/system/files/2021-11/17-11-2021-edps_decision_authorising_temorarily_use_of_cjeu-cisco_ad_hoc_clauses_for_transfers_cisco_webex_1.pdf EDPS Decision 2021]) in the context of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Chapter V of Regulation (EU) 2018/1725] (EU GDPR). In that decision, the EDPS set 14 conditions that the CJEU was required to meet for the renewal of the authorisation. In October 2022, following an assessment of the CJEU’s implementation report, the EDPS extended temporarily and conditionally the authorisation to use the mentioned contractual clauses ([https://edps.europa.eu/system/files_fr?file=2023-03/2023-0250_001_redacted.pdf EDPS Decision 2022]). In that decision, the EDPS called on the CJEU to clarify several outstanding issues and to introduce further changes to the contractual obligations between the Court and Cisco Systems Inc. US. The CJEU was required to ensure an essentially equivalent level of protection within 16 months after the date of the EDPS Decision 2022 (i.e. by 1 March 2024), by remedying the compliance issues identified in that decision. Thereafter, in May 2023, the CJEU provided a compliance report and newly redrafted contractual clauses (together ‘the documentation’) to the EDPS to demonstrate the implementation of the conditions set in the EDPS Decision 2022. The CJEU requested for an authorisation of contractual clauses under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 48(3)(a) of the EU GDPR] to be concluded between the CJEU and Cisco Systems Inc. US, in the context of transfers of personal data ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Chapter V of the EU GDPR]) in the CJEU’s use of Cisco Webex and related services. (i) No transfers of personal data The EDPS took into account that the personal data in question was processed and stored within the European Economic Area (EEA). Moreover, it was noted that Cisco UK did not have access to the data of the CJEU by default, and in any case Cisco UK did not access the data without explicit authorisation. Also, none of Cisco’s sub-processors located outside of the EEA had a default remote access to the CJEU’s data processed in the EEA. Furthermore, the EDPS noted that there were technical measures in place, such as end-to-end encryption (Zero Trust Security End-to-End encryption), that effectively prevented Cisco’s access to real time (meeting) data of the CJEU. The use of the Zero Trust Security End-to-End encryption was considered, by the EDPS, as one of several technical measures significantly contributing to the integrity and confidentiality of the processing operations. In light of the above, the EDPS found that there were no transfer(s) of personal data or otherwise making personal data available by the CJEU to Cisco UK, because the latter was contractually excluded from having access to or accessing personal data on behalf of the CJEU. (ii) Merely potential and unforeseeable transfers do not fall under Chapter V of the EU GDPR The EDPS held that transfers resulting from unauthorised access by third country entities, which are merely potential and in no way foreseeable, in light of the content or purpose of a contract, do not fall under the scope of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Chapter V of EU GDPR]. In the EDPS’s view, the unlikely and unplanned character of such risks of such unauthorised access made them unsuitable to be ex ante subjected to the regime of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Chapter V of the EU GDPR]. It followed, that the EDPS held that for such potential and unplanned transfers, a transfer tool under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Chapter V] is not required. In the present case, the EDPS viewed that the transfers resulting from possible remote governmental access to data located in the EEA, (possible under the laws of the United States), are not envisaged nor planned under the contract between the CJEU and Cisco UK. In that sense, the CJEU was considered not to have planned for such transfers to take place in the broader context of the execution of the contract or the CJEU’s ‘stable relationship with Cisco Webex entities’. Based on the above, the EDPS held that potential transfers of data located in the EEA resulting from the application of third-country laws are not covered by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Chapter V of the EU GDPR], and the Court does not need to provide for appropriate safeguards for them by means of contractual clauses. (iii) Contractual exceptions that may lead to transfers of personal data However, the contract did include exceptions to the territorial limitations on processing personal data resulting from specific actions (e.g. when a user makes a technical assistance request or contract management). The EDPS found that in those exceptional situations, transfer(s) of personal data in the context of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Chapter V of the EU GDPR] may take place. Based on the documentation, the EDPS found that the CJEU had mitigated the application of such exceptions, in a way, that effectively prevented the transfers from taking place. In addition, the EDPS noted that the CJEU had introduced additional organisational measures aimed at limiting the transfer(s) of personal data. Based on the documentation, the EDPS also considered that the measures introduced by the CJEU effectively prevented the chance that such exceptions were triggered. As a result, even though transfers remained foreseen, the CJEU’s additional internal measures were seen to effectively prevent such transfers from taking place. It followed, that the EDPS held that in those circumstances the transfers did not require an authorisation under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 48(3)(a) of the EU GDPR]. With regard to a transfer of personal data resulting from a user’s technical assistance request, the EDPS held that the CJEU may rely on the derogation provided for under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 50(1)(d)] (transfer is necessary for important reasons of public interest) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 and (3) of the EU GDPR]. In addition, with regard to transfers resulting from contract management, the EDPS held that the CJEU could also rely on the derogation provided for under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 50(1)(d)] (transfer is necessary for important reasons of public interest) and [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 (3) of the EU GDPR]. Thus, such transfers were considered to be not fall within the scope of the present decision. Conclusion As a result of the above assessment, the EDPS concluded that the CJEU had complied with the conditions that were imposed within the previous EDPS decisions in 2021 and 2022, and issued a decision in accordance with [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 57(1)(n)] and [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 58(3)(e) of the EU GDPR]. The EDPS found that there were no data transfers that would fall under the scope of an authorisation under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 48(3)(a) of the EU GDPR]. The decision was said to be without prejudice to the investigative and corrective powers of the EDPS under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 58 of the EU GDPR].