Data Transfer Impact Assessment

Overview

This document provides information to help Worksuite customers conduct data transfer impact assessments in connection with their use of Worksuite products and services, in light of the “Schrems II” ruling of the Court of Justice for the European Union and the recommendations from the European Data Protection Board.

In particular, this document describes the legal regimes applicable to Worksuite in the US, the safeguards Worksuite puts in place in connection with transfers of customer personal data from the European Economic Area, United Kingdom or Switzerland (“Europe”), and Worksuite’s ability to comply with its obligations as “data importer” under the Standard Contractual Clauses (“SCCs”).

For more details about Worksuite’s GDPR compliance program please visit this page

Step 1: Know your transfer

Where Worksuite processes personal data governed by European data protection laws as a data processor on behalf of customers, Worksuite complies with its obligations under its Data Processing Addendum (“DPA”) available on this page.

Worksuite DPA incorporates the SCCs and provides the following information:

• description of Worksuite’s processing of customer personal data (Exhibit A); and
• description of Worksuite’s security measures (Exhibit B)

Please refer to Exhibit A for information on the nature of Worksuite’s processing activities in connection with the provision of the Services, the types of personal data we process and transfer, and the categories of data subjects.

A list of all of our data subprocessors where you can stay up-to-date on changes is available at subprocessors.

We may transfer customer personal data wherever we or our third-party service providers operate for the purpose of providing you the Services. The locations will depend on the particular Worksuite Product and Services you use, as outlined in the chart below:

U.S. Surveillance Laws

FISA 702 and Executive Order 12333

The following US laws were identified by the Court of Justice of the European Union in Schrems II as being potential obstacles to ensuring essentially equivalent protection for personal data in the US:

• FISA Section 702 (“FISA 702”) – allows US government authorities to compel disclosure of information about non-US persons located outside the US for the purposes of foreign intelligence information gathering.  This information gathering must be approved by the Foreign Intelligence Surveillance Court in Washington, DC.  In-scope providers subject FISA 702 are electronic communication service providers (“ECSP”) within the meaning of 50 U.S.C § 1881(b)(4), which can include remote computing service providers (“RCSP”), as defined under 18 U.S.C. § 2510 and 18 U.S.C. § 2711.
• Executive Order 12333 (“EO 12333”) – authorizes intelligence agencies (like the US National Security Agency) to conduct surveillance outside of the US.  In particular, it provides authority for US intelligence agencies to collect foreign “signals intelligence” information, being information collected from communications and other data passed or accessible by radio, wire, and other electromagnetic means. This may include accessing underwater cables carrying internet data in transit to the US.  EO 12333 does not rely on the compelled assistance of service providers but instead appears to rely on exploiting vulnerabilities in telecommunications infrastructure.

Further information about these US surveillance laws can be found in the U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S.Data Transfers after Schrems II whitepaper from September 2020. This whitepaper details the limits and safeguards pertaining to US public authority access to data and was issued in response to the Schrems II ruling.

Regarding FISA 702 the whitepaper notes:

• For most companies, the concerns about national security access to company data highlighted by Schrems II are “unlikely to arise because the data they handle is of no interest to the U.S. intelligence community.” Companies handling “ordinary commercial information like employee, customer, or sales records, would have no basis to believe US intelligence agencies would seek to collect that data.”
• There is individual redress, including for EU citizens, for violations of FISA section 702 through measures not addressed by the court in the Schrems II ruling, including FISA provisions allowing private actions for compensatory and punitive damages.

Regarding Executive Order 12333 the whitepaper notes:

• EO 12333 does not on its own “authorize the U.S. government to require any company or person to disclose data.” Instead, EO 12333 must rely on a statute, such as FISA 702 to collect data.
• Bulk data collection, the type of data collection at issue in Schrems II, is expressly prohibited under EO 12333.

CLOUD Act

For more information on the CLOUD Act, review What is the CLOUD Act? by BSA Software Alliance outlining the scope of the CLOUD Act.

The whitepaper notes:

• The CLOUD Act only permits U.S. government access to data in criminal investigations after obtaining a warrant approved by an independent court based on probable cause of a specific criminal act.
• The CLOUD Act does not allow U.S. government access in national security investigations, and it does not permit bulk surveillance

Is Worksuite subject to FISA 702 or EO 12333?

Worksuite, like most US-based SaaS companies, could technically be subject to FISA 702 where it is deemed to be a RCSP.  However, Worksuite does not process personal data that is likely to be of interest to US intelligence agencies.

Furthermore, Worksuite is not likely to be subject to upstream surveillance orders under FISA 702, the type of order principally addressed in, and deemed problematic by, the Schrems II decision.  Worksuite does not provide internet backbone services, but instead only carries traffic involving its own customers.   To date, the U.S. Government has interpreted and applied FISA 702 upstream orders to only target market providers that have traffic flowing through their internet backbone and that carry traffic for third parties (i.e., telecommunications carriers).

EO 12333 contains no authorization to compel private companies (such as Worksuite) to disclose personal data to US authorities and FISA 702 requires an independent court to authorize a specific type of foreign intelligence data acquisition that is generally unrelated to commercial information. In the event that US intelligence agencies were interested in the type of data that Worksuite processes, safeguards such as the requirement for authorization by an independent court and the necessity and proportionality requirements would protect data from excessive surveillance.

What is Worksuite practical experience dealing with government access requests?

To date, Worksuite has never received a US National Security Request (including requests for access under FISA 702 or direct access under EO 12333) in connection with a customer.

Therefore, while Worksuite may technically be subject to the surveillance laws identified in Schrems II we have not been subject to these types of requests in our day-to-day business operations.

Step 4: Identify the technical, contractual, and organizational measures applied to protect the transferred data

Worksuite’s contractual measures are set out in our Data Processing Addendum which incorporates the SCCs. In particular, we are subject to the following requirements:

• Technical measures: Worksuite is contractually obligated to have in place appropriate technical and organizational measures to safeguard personal data
• Transparency: Worksuite is obligated under the SCCs to notify its customers in the event it is made subject to a request for government access to customer personal data from a government authority.
• Actions to challenge access: Under the SCCs, Worksuite is obligated to review the legality of government authority access requests and challenge such requests where they are considered to be unlawful.

Worksuite’s organizational measures to secure data include:

• Policy for government access: Worksuite publishes and follows Worksuite Guidelines for Law Enforcement Requests in responding to any government requests for data. To obtain data from Worksuite, law enforcement officials must provide legal process appropriate for the type of information sought, such as a subpoena, court order, or a warrant.
• Onward transfers: Whenever we share your data with Worksuite service providers, we remain accountable to you for how it is used. We require all service providers to undergo a thorough cross-functional diligence process by subject matter experts in our Security, Privacy, and Risk & Compliance Teams to ensure our customer’s personal data receives adequate protection.
• Employee training:  Worksuite provides data protection training to all Worksuite staff.

Step 5: Procedural steps necessary to implement effective supplementary measures

In light of the information provided in this document, including Worksuite’s practical experience dealing with government requests and the technical, contractual, and organizational measures Worksuite has implemented to protect customer’s personal data, Worksuite considers that the risks involved in transferring and processing European personal data in/to the US do not impinge on our ability to comply with our obligations under the SCCs (as “data importer”) or to ensure that individuals’ rights remain protected. Therefore, no additional supplementary measures are necessary at this time.

Step 6: Re-evaluate at appropriate intervals

Worksuite will review and, if necessary, reconsider the risks involved and the measures it has implemented to address changing data privacy regulations and risk environments associated with transfers of personal data outside of Europe.