Hi !
Our third-country assessment (Transfer Impact Assessment, TIA) of Taiwan is finally complete! We have published it here.
Part of the DPIA project has been conducting third-country assessments or Transfer Impact Assessments (TIA) for the countries that can transfer personal data if you use Google Workspace for Education.
And now, one of them is complete.
What have we learned that you can also benefit from?
If we were to summarize the lessons from this TIA, they would be:
1 Conducting a TIA involves researching and seeking information on laws in third countries. It is a lonely and tedious process.
We wish there were a nicer way to say this, but the truth is that the start of a TIA is very tough. You will spend a lot of time searching for information that may be relevant but is not necessarily so.
You fumble in the dark. It's particularly tough not knowing whether what you're doing will lead to anything productive.
And once you know this, you can set up the work so it's not so tough. For us, it has been crucial to hire assistance from those who are more expert than we are (Kvale Law Firm), to have someone to spar with who can tell us that we're not completely off base.
We've also built in breaks in our work. When it's stressful to read up on things you don't know if will be part of the TIA, you need breaks. This can be in the form of other work tasks, such as writing an article or preparing a lecture. Or it can simply be a break.
2 You don't need to involve experts from the third country as long as you manage to reduce uncertainty
Conducting a TIA means assessing laws in another country. There's a lot of uncertainty involved. As a Norwegian lawyer or privacy advisor, you cannot be sure that you are making a correct assessment.
This is because the laws must be translated from a foreign language to Norwegian, and because they exist in a legal tradition that makes it difficult for you to interpret them.
When we finished the assessment for Taiwan, we had a theory that we wouldn't have needed to consult local experts from Taiwan to have our assessment confirmed. We were simply so confident in the assessment, that if we hadn't had the resources, we would have stopped the assessment without involving Taiwanese lawyers.
We were right. The Taiwanese experts confirmed that we had made a good assessment.
And when we say "we," we are primarily talking about Ola Høyer, a lawyer in Bergen municipality. He is the brain behind this assessment.
But it's hard to know we were right in our assessments until a local expert has reviewed it.
3 There is no magic formula to reduce uncertainty, but clear frameworks and thorough assessments will help
The task of identifying and assessing applicable law in a third country is inherently uncertain. And this is especially true if one bypasses local expertise or excludes oneself as an expert!
Ola once spoke with an experienced consultant about this topic. He was curious about how he could make his own work more efficient and asked somewhat flippantly if the consultant had any advice regarding uncertainty in conclusions and how far one must go in these assessments.
"Find out how much money the customer is willing to spend," the consultant said bluntly.
At the moment, Ola didn't understand what the consultant meant. It all seemed like a typical line from a business-oriented consultant. But later, he realized that the point was not only solid—it was also descriptive of the kind of task one actually takes on when conducting a TIA.
There are virtually no limits to how deeply one can delve into foreign legislation. It all boils down to a question of resources and how far the customer or you are willing to go.
To reduce uncertainty in conclusions, it is thus important to 1) establish clear frameworks, and 2) conduct thorough assessments.
What do we mean by this?
Clear Frameworks
There is often significant overlap between surveillance and intelligence legislation and national criminal law/procedure. If a third country criminalizes actions that are otherwise lawful in the EU, such fundamental differences must naturally be addressed in a TIA.
Even though criminal law is relevant in a TIA, it is seldom necessary to account for the complete criminal legal landscape. If the national criminal law is not radically different from the European, and the transfer does not involve the flow of data that is potentially criminalized in the EU, the project's view is that it is not necessary to conduct extensive investigations of national criminal law.
Criminal law is a complicated affair in any country one looks at. And if the ambition is to acquire knowledge one otherwise would not have access to, this might rather be a hobby project.
The point is that it is not practical to put most of the effort here if it is strictly not necessary.
Thorough Assessments
To conclude without assistance from local expertise, thoroughness is very important in the assessments. Unfortunately, there is no way around it.
The problematic laws must be read carefully and understood in light of other available legal sources. This requires effort and patience.
How?
We have created a procedure / checklist / Standard Operational Procedure (SOP) that you can base your work on, and you can read it here.
How do we work with TIAs?
Here you can listen to us talk about how we work with this on a LinkedIn Live we have previously had.
Rebecca will talk about this at the Privacy Days in Trondheim on September 17 and 18, 2024. Check out the program here https://eyd.tech/personverndagene/program-1#Program_dag_2 and use the discount code "INVITED20" when you register to get a 20% discount.
Can't make it to the Privacy Days? Ola and Ida will talk about third-country assessments on Friday, 18.10.24 from 12:00 to 13:00 at SkoleSec's "Gathering Around the Campfire."
This is a series of meetings on Teams that you can be invited to via Outlook, so reply to this email to be invited, or log into the meeting on Friday 18.10 via this link.
I wish you a wonderful, privacy-friendly week-end!
Best regards,
Ida Thorsrud
Project manager national DPIA
This newsletter was translated from Norwegian to English with assistance from ChatGPT by OpenAI. While it guided our translation, we made independent editorial choices. Any discrepancies result from this combined approach.
