by Ronan Tigner and Alex van der Wolk
Since the decision of the European Court of Justice (“ECJ”) in the Schrems II case, transfers of personal data from the EU to the United States have been under scrutiny. The ECJ reviewed the situation where personal data are sent from an EU affiliate to its U.S. headquarters as part of how the company structured its business-as-usual practices. But what the ECJ did not consider is whether the mere fact that an EU company is affiliated with a U.S.-headquartered company is problematic, even if no transfer of personal data to the United States takes place.
Whether merely being affiliated with a U.S.-headquartered company is a problem from a data transfer perspective is precisely what a number of associations (“claimants”) and the French data protection authority (“CNIL”) argued in a recent appeal before the French Council of State. This question arose in the context of a case involving Microsoft Ireland in respect of its hosting of French public health data. The claimants and the CNIL argued that any affiliation of an EU hosting provider, in this case Microsoft Ireland, with a U.S. parent company, in this case Microsoft U.S., is in and of itself problematic. The claimants and the CNIL contended that because of such affiliation, U.S. authorities could have jurisdiction over data held by Microsoft Ireland in the EU. As a result, the claimants called for the immediate suspension of the use of Microsoft Ireland, even though Microsoft Ireland had already committed to storing the data in a pseudonymized form in the EU. The French Council of State, however, denied the immediate suspension of the use of Microsoft. While this seems like a good outcome for transatlantic commerce, the Council’s decision suggests that in the future, organizations will be required to use a French-based cloud solution. We provide further details below.