Privacy-Shield unzulässig: So reagier(t)en die großen US-Anbieter (2020)

Adobes Reaktion zum Privacy-Shield-Urteil im Wortlaut

Dear EU-CON,

Thank you for your inquiry.

Like many companies operating at scale in the software industry, Adobe had availed itself of both personal data transfer mechanisms:
SCCs and Privacy Shield. Now that Privacy Shield has been invalidated, Adobe will rely on the SCCs to support transfers of personal data from the EU to non-EU countries (e.g., to the U.S.).

Adobe has prepared a Data Processing Agreement (DPA) that includes the Standard Contractual Clauses (SCCs). If you are an Adobe business customer and want to enter into a DPA and SCCs with Adobe, please request those documents from us.

We trust this addresses your questions.

Best regards,

Adobe Privacy Support

Amazon Web Services Reaktion zum Privacy-Shield-Urteil im Wortlaut

Hi EU-CON,

Thank you for contacting us.

You can refer to this article for further information regarding recent developments of EU-US Privacy Shield and SCC. SCCs are also part of AWS GDPR DPA.

Please don’t hesitate to contact me for further help.

Best regards, 
M.T.

Atlassians Reaktion zum Privacy-Shield-Urteil im Wortlaut

Hi EU-CON,

Privacy and Security are among the highest priorities at Atlassian. Atlassian is following the developments around the recent decision by the Court of Justice of the European Union regarding the EU-US Privacy Shield and we are comprehensively assessing the implications for our company.

Atlassian anticipated this issue and has an in-built solution in our DPA. While the EU-US Privacy Shield may have been invalidated in this ruling, please note that Atlassian’s Data Protection Addendum includes language (see Section 6.2) that provides for Standard Contractual Clauses (SCCs) as a fallback data transfer mechanism for personal data from the EU to be transferred to the US in the event of the invalidation of Privacy Shield. In the decision, we understand that the court upheld SCCs as a valid data transfer mechanism for transfers of personal data from the EU to the US at this time.

Atlassian remains committed to ensuring our customers' data is protected with the utmost care and in compliance with applicable data privacy laws and requirements. Please be assured, to the extent we have ongoing obligations under our Privacy Shield certification, we will continue to honor them. The Swiss-EU Privacy Shield remains operational and is not currently impacted.

For more information see https://www.atlassian.com/trust/privacy/gdpr#data-transfers

W. T.

Product Advocate | Austin, TX

Calendly Reaktion zum Privacy-Shield-Urteil im Wortlaut

Hi EU-CON,

Thanks for reaching out to Calendly Support!

We take data privacy and protection very seriously, including the transfer of personal data from the EU to the US. Calendly has incorporated the Standard Contractual Clauses into its Data Processing Agreements as its transfer mechanism, an approved safeguard and a recognized alternative to Privacy Shield.

Calendly is monitoring the legal challenges to the Privacy Shield framework but is continuing to explore whether it will certify to it.
In the meantime, the Standard Contractual Clauses ensure that adequate safeguards are in place for any onward transfers of personal data to Calendly.

We also have more information about data storage and Privacy Shield in our Help Center:

Data storage and Privacy Shield

In regards to GDPR, as a Calendly user (i.e., someone who has signed up for a Calendly account), Calendly is a processor of your invitees’ data. In technical terms, you are the controller. When an invitee schedules a meeting with you, you retain ownership and responsibility of that data.

I hope this helps!

E. at Calendly

Leadpages Reaktion zum Privacy-Shield-Urteil im Wortlaut

Hey EU-CON!

S. here with Leadpages. I know that making this information easy to find is really important.

We generally provide basic information for our customers, most of it applies to GDPR, but also a little about Privacy Sheild.

From our article: Leadpages will not be self-certifying with US Privacy Shield, but instead committing to the EU Standard Contractual Clauses (SCCs) in our Data Processing Agreement, which cover the EU's requirements for international data transfer. Since you're transferring data to Leadpages only for processing purposes, the contract we provide will do.

You can also take a look at our knowledge base article and in-depth blog post for more information on Leadpages and GDPR!

If I am understanding your questions correctly, more direct answers would be that yes, we are compliant with GDPR, we are not relying on Privacy Sheild, we have no plans to move our servers to the EU.

I am not sure I understand what you asked about SCC.

Let me know if there is anything else I can do for you, have a great day!

Best wishes,

S.

Postmark Reaktion zum Privacy-Shield-Urteil im Wortlaut

Hi EU-CON,

Good to hear from you!

Although we don't have any current plans to have servers in the EU, we're aware of the changes with the privacy shield and the good news is that we're still GDPR compliant despite the ruling.

• As of now, the Standard Contractual Clauses (SCC) are still valid.
  The big difference is that those have to be agreed to individually, and can't be applied to all of our customers at once like Privacy Shield.
• Here's the important part: Our DPA includes the Standard Contractual Clauses in Exhibit C. So if you visit and sign our DPA you'll still be fully covered under GDPR because it includes SCC.

Definitely let us know if you run into any specific questions, as we're very happy to help. Thanks and have a wonderful day!

J.D.

Slack Reaktion zum Privacy-Shield-Urteil im Wortlaut

Hello EU-CON,

Thank you for reaching out. I'm happy to provide you with an overview of our safeguards and mechanisms in place:

We've reviewed the Court of Justice of the European Union’s judgement, and are confident that we can continue business as usual, relying on other legitimate methods of transferring data between the European Union and the United States, such as our standard contractual clauses (SCCs). We provide support to our customers for compliance with international data transfers by executing Standard Contractual Clauses through our Data Processing Agreements. For more information, Customers can find Slack’s Data Processing Agreements at this link: https://slack.com/intl/en-ie/terms-of-service/data-processing

The focus of Slack’s security program is to prevent unauthorized access to customer data and we’re committed to being transparent about our security practices and helping customers understand our approach. Please see Slack’s Security Whitepaper for more information on encryption standards and other technical and organizational measures in place.

Please see our Data Request Policy, and Transparency Report for more information on the measures we put in place to protect customers from unlawful surveillance and disclosure of personal information.

Please also note that Slack has a number of features to allow more granular control and access to data including:

• Enterprise Key Management: Complete control and visibility of access to your data in Slack using your own encryption keys. Available on Enterprise Grid.
• International Data Residency: Slack's data centers are hosted globally, with Amazon Web Services (AWS). The data center hosting location applicable to each Slack customer can vary if the organization uses our data residency feature. Data residency for Slack allows global teams to choose the region where certain types of data at rest are stored while fulfilling corporate policies and compliance requirements. Available on Plus and Enterprise Grid plans.

Best,

Privacy at Slack

SurveyMonkey Reaktion zum Privacy-Shield-Urteil im Wortlaut

Hello EU-CON,

Sorry for the delay in getting back to you, but I'll be happy to shine some light on this with you!

We are currently reviewing the recent Court of Justice EU decision around data privacy with our legal team and Data Protection Officer to determine what additional steps SurveyMonkey will take to address this judgment and data transfers to the US. In the meantime, we note that this decision did not invalidate the use of Standard Contractual Clauses (SCCs) as a mechanism for transfer of data outside the European Union.

SurveyMonkey currently offers our customer data processing agreement (DPA) with SCCs to all self serve customers (see here) and the SCCs are incorporated in our MSA for Enterprise customers.  Rest assured that if you have previously applied the DPA to your account using our form, then this is still valid after the court’s decision.

If you do not currently have the DPA applied to your account you can do so now at the link above.

I do hope this helps, and please feel free to let me know if you have any further questions or requests and I'll be happy to assist!

Warm regards,

S.

WordPress.om Reaktion zum Privacy-Shield-Urteil im Wortlaut

Hi EU-CON,

due to the recent ruling of the European Court of Justice regarding the inadmissibility of the Privacy-Shield Agreement, I am contacting you to find out how you see the matter and treat it accordingly.

As far as we are informed, the possibility of using so-called SCC clauses and the use of so-called corporate binding rules or a switch of your servers to the European Union is currently available.

For a blog article that is intended to give German companies an overview of how well known US service providers are dealing with the overturned privacy shield agreement, I would like to ask for your quick feedback on this.

Thank you for your message. Automattic is committed to helping our customers run their sites and online businesses in a manner that complies with the GDPR’s data protection and data transfer laws.

One way we are fulfilling our commitment is by providing a Data Processing Agreement, which is a contract that documents Automattic’s compliance with the GDPR requirements that apply to us as a data processor for your site. The Agreement also satisfies the requirement for standard model clauses that govern the transfer of your data to Automattic and its subsidiaries.

The EU court ruling you're referring to found that Standard Contractual Clauses (SCCs) are valid as a legally recognized guarantee for data protection. Our DPA includes SCCs.

DPAs are contractual tools for web sites and companies to make commitments to their customers, vendors, and partners that their data handling complies with the law. It is not relevant or needed for the typical free site owner or hobbyists. Having a DPA does not change any of our practices regarding your site or your visitors. Everyone on WordPress.com gets the same high standards of privacy and security.

You're welcome to request a DPA by logging in to your account on WordPress.com, and clicking the "Request a DPA" button at https://wordpress.com/me/privacy in your dashboard.

This will automatically send a DPA to your account's email address which you can sign and return to privacypolicyupdates@automattic.com for processing.

I hope that helps. Let us know if you have any further questions.

Regards,

V.