Must the data importer inform data subjects about requests for data disclosure received from a public authority? What if the data importer is prohibited from providing such information under national law?

ANSWER

According to Clause 15.1(a) of the SCCs, the data importer must notify the affected individuals, if it receives a request for the disclosure of personal data, from a public authority or court in a third country. In addition, the data importer must notify the data exporter if it becomes aware of any actual access (e.g., interception) by public authorities to such data. At the same time, the SCCs recognize that providing this information may be impossible for legal or practical reasons.

In particular, the data importer may be subject to a prohibition (under national law) on informing individuals about specific instances of access by public authorities. In such cases, the data importer should use its best efforts to obtain a waiver of that prohibition, with the aim of communicating as much information as possible, as soon as possible.

Furthermore, in practice it may be difficult to contact the data subjects directly (for example, because the data importer has no direct relationship with them). In this regard, Clause 15.1(a) expressly states that the data importer may seek assistance from the data exporter (who may be able to contact the affected individuals directly).