gdpr european-union data-protection
Impact of GDPR on remote work outside of the EU (as LLC)?
<p>I do remote work for clients in the EU. The legal foundation is a B2B contract between two EU legal entities, one of which is the client's limited company, the other my limited company. Since both legal entities are in the EU, they are subject to GDPR laws. However, I as a person would like to perform my duties outside of the EU. Can I do this?</p>
<p>Most answers I found were in the context of being an Employee of a company in the EU (or processing EU citizens' data), who wants to work from outside of the EU. So there was an employer-employee relationship, tax implications etc. In my case, I am the sole shareholder of the limited company, my tax situation is separate to this question (I know there are implications). The only legal relationship in scope of this question is client-service provider, where I am the service provider.</p>
<p>I know there are many companies which hire employees in non-EU countries (India comes to mind) or subcontract them to perform some tasks, which leads me to believe this should be possible.</p>
<p>The work itself is strongly focused on processing sensitive information. It is stored in a cloud system provided by a third-party vendor, it's certified and highly secure. My role is to interact with this system. All connections are encrypted. To perform my duties I use two computers. One is provided by the client, so I follow all their policies around data and IT security. This is the only device that is used to access client's systems. The other computer is mine. It secures data at rest (hard drive encryption), web connections are encrypted (https), I use VPN, and I don't store data on my device for longer than necessary to perform my duties. I do not maintain a database of any sort. My job is to write programs to process client data. Programs run only within the third-party system that I mentioned before. To summarize, I download the data I need to write a program locally on my computer (the program does not interact with the outside world at this stage), once I am confident it works, it is uploaded to the secure system, where it would process all of client's data in a secure fashion. In other words, data would leave the EU for the purpose of developing the software only. Note it would not be processed in the United States. I do not share the data with any third parties. Currently, I do not have any Employees, so there is no data sharing even within my own organization. My services are not public facing.</p>
<p>I hope this gives a good understanding of what my situation is. What I would like to know:</p>
<ol>
<li>Is it legal for me to perform my duties from anywhere outside of the EU at my own discretion?</li>
<li>Is data security I outlined sufficient to be GDPR compliant?</li>
<li>Most of the contracts I signed in the past did not require me explicitly to be physically present in the EU and they allowed me to subcontract the work as long as the subcontractor had necessary skills. If the contract does not explicitly state all work must be physically carried out in the EU, can I do it outside of the EU without explicit clause in the contract, i.e. what's not forbidden is permitted?</li>
</ol>

<p>This is a tricky question that cannot be fully answered in the context of this site, but it is possible to discuss certain aspects:</p>
<ul>
<li>Does GDPR even apply?</li>
<li>Who is the data controller?</li>
<li>What is the legal basis for the international transfer?</li>
<li>Conclusion, including short discussion of your three questions</li>
</ul>
<h2>Does GDPR even apply?</h2>
<p>The GDPR applies to all processing of personal data where</p>
<ul>
<li>the personal data forms a filing system or processing is performed using automated means; and</li>
<li>the processing occurs in the context of
<ul>
<li>an establishment in the EU; or</li>
<li>an offering of goods or services to people in the EU; or</li>
<li>monitoring behaviour of people who are in the EU.</li>
</ul>
</li>
</ul>
<p>(And wherever I say “EU” I mean “EEA or UK”.)</p>
<p>Your company clearly has an establishment in the EU and would then be fully in-scope of the GDPR for all its processing of personal data. However, by you working from outside of the EU this company might also have an establishment outside of the EU. Then, the question is to which establishments a processing activity should be attributed. It is possible that a processing activity occurs in the context of multiple establishments. If the processing activities were to be attributed solely to a non-EU establishment, GDPR wouldn't apply. For example, an EU-based retail chain might have a store in Switzerland. This store processes personal data such as payroll for staff and card payments for customers. Since these processing activities occur solely in the context of the Swiss store, GDPR wouldn't apply to them.</p>
<p>This might not apply to your case though, since the processing activity is not independent from your company's main establishment.</p>
<p>Another reason why GDPR wouldn't apply is if the sensitive data in question is not personal data. For example, corporate financial details might be sensitive without being personal data.</p>
<p>For the remainder of this answer I will assume that the GDPR does apply because the processing activities occur in the context of an establishment in the EU, and that the data being processed is personal data.</p>
<h2>Who is the data controller?</h2>
<p>Under GDPR, the data controller is responsible for ensuring GDPR compliance. There can be more than one data controller.</p>
<p>Your company's client is definitely a data controller. They can only give the personal data to a third party if (a) they have a legal basis, or (b) they engage this third party as a data processor that will <em>only</em> process the data as instructed by the controller.</p>
<p>So depending on the contractual relationship your company would be another controller, or a processor working on behalf of the controller.</p>
<p>If your company is a controller then it is responsible for ensuring data protection. This will become relevant in the next section.</p>
<p>If your company is a data processor then things are much simpler: you can only use the data as you have been instructed to. You must not use the personal data for your own purposes. You cannot engage sub-processors without consent from the controller.</p>
<p>A data processor always has a contract (often called a <em>data processing agreement</em>, DPA) that conforms with Art 28 GDPR. In this contract, the controller instructs the processor to implement security measures, and also whether the processor can transfer the personal data to third countries. (A third country is any non-EEA country).</p>
<p>Your company is most likely such a data processor, because otherwise your company's client has likely messed up. But for the following, let's assume that your company is a controller or that the DPA authorizes you to make international transfers.</p>
<h2>What is the legal basis for the international transfer?</h2>
<p>The GDPR prohibits international transfers of personal data into countries outside of the EEA, unless one of the following hold:</p>
<ul>
<li>the target country has received an <em>adequacy decision</em> which attests a broadly equivalent level of data protection;</li>
<li>the transfer is protected by appropriate safeguards, generally on the basis of Standard Contractual Clauses (SCCs); or</li>
<li>one of the exceptions in Art 49 applies.</li>
</ul>
<p>I don't want to discuss Art 49 here because it is unlikely to apply. This involves exceptions like everything is OK if the data subject has given their explicit consent after being informed of the risks, or that the transfer is necessary to fulfil a contract with the data subject, like a hotel booking in Singapore.</p>
<p>SCCs are popular but non-trivial to apply correctly. They are a bit like a data processing agreement, though with standardized clauses that try to ensure data protection through contractual mechanisms instead of laws. The tricky part is that the data exporter must ensure that the data importer is actually legally able to sign these clauses. For example, when the target country has surveillance laws that would require the data importer to disclose personal data to the government, those laws would conflict with the SCCs and the transfer would be invalid.</p>
<p>This issue gained prominence in the wake of the 2020 “Schrems II” ruling, after which EU–US transfer could no longer rely on an adequacy decision. The EDPB has issued <a href="https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/recommendations-012020-measures-supplement_en" rel="nofollow noreferrer">recommendations 01/2020 on measures that supplement transfer tools</a> so that transfers into countries are possible where SCCs otherwise wouldn't be valid. TL;DR: use end to end encryption or strong pseudonymization methods so that the data is useless even if it falls into the wrong hands. For example, I could legally store encrypted backups in the US. Of course, these measures also make more interesting processing activities impossible, such as the analysis you intend to make.</p>
<p>Note that a “transfer” is generally understood to not only involve copies of personal data for later processing, but already mere access to the personal data from a non-EU country. So keeping the data on an EU-based server and remoting into that server wouldn't work either.</p>
<h2>Conclusion</h2>
<p>I have outlined various factors that could affect whether such processing outside of the EU would be allowed. I think the most important factor is what your contract says, followed by your legal basis to perform an international transfer. My hunch is that your transfers would not be legal.</p>
<p>Given this background, your three questions can be briefly answered:</p>
<ol>
<li>
<blockquote>
<p>Is it legal for me to perform my duties from anywhere outside of the EU at my own discretion?</p>
</blockquote>
<p>Yes, if your company is a data controller and has a legal basis for this international transfer. If your company is a data processor, it must abide by the controller's instructions.</p>
</li>
<li>
<blockquote>
<p>Is data security I outlined sufficient to be GDPR compliant?</p>
</blockquote>
<p>Those measures sounds like reasonable security measures in the sense of Art 32 GDPR, regardless of where the data processing is performed.</p>
<p>However, they are not sufficient to authorize a transfer into a third country. They fall short of supplemental measures recommended by EDPB 01/2020, for example because these measures are susceptible to an <a href="https://xkcd.com/538/" rel="nofollow noreferrer">xkcd 538</a> attack (if you and the data are in a non-EU country, and you have the ability to decrypt the data, then the non-EU government could legally order you to violate your SCCs).</p>
</li>
<li>
<blockquote>
<p>If the contract does not explicitly state all work must be physically carried out in the EU, can I do it outside of the EU without explicit clause in the contract, i.e. what's not forbidden is permitted?</p>
</blockquote>
<p>If your company is a data processor, it can only perform international transfers if explicitly authorized to do so via the DPA.</p>
</li>
</ol>
