COMPLIANCE WITH EUROPEAN UNION DATA TRANSFER REQUIREMENTS & THE NEW STANDARD CONTRACTUAL CLAUSES

Khoros is committed to protecting the data that you entrust to us and safeguarding the transfer of personal data transferred from the European Union (EU), European Economic Area (EEA) and United Kingdom (UK) to our facilities and subprocessors in the United States (US) and other countries.

The Legal Landscape for Personal Data Transfer

On July 16, 2020, the Court of Justice of the European Union (CJEU) issued its judgment in Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (Schrems II). The CJEU held that US laws do not ensure an essentially equivalent level of protection for personal data compared to the EU, citing the breadth of US surveillance programs (particularly Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333). Consequently, the court invalidated Privacy Shield (a certification program through the US government for data transfers from the EU to the US). Although the CJEU noted some concerns with the Standard Contractual Clauses (SCCs) as a means to transfer European personal data, the CJEU maintained the SCCs’ validity so long as there were effective mechanisms in place to ensure an “essentially equivalent level of protection.”

Nearly a year later, on June 4, 2021, the European Commission finalized and adopted a new set of standard contractual clauses (“New SCCs”). The New SCCs replace prior versions of the SCCs (the “Old SCCs”). The New SCCs contain additional requirements aimed at addressing the concerns raised in Schrems II.

Although the New SCCs address concerns announced in Schrems II, on June 18, 2021, the European Data Protection Board (EDPB) adopted final recommendations on supplemental technical and organization measures to supplement transfer tools and ensure compliance with EU data protection requirements (the “EDPB Recommendations”).

Finally, due to the ruling in Schrems II and Brexit, on August 11, 2021, the UK Commissioner’s Office (ICO) launched a consultation on its draft international data transfer agreement (IDTA) and guidance for organizations on international transfers (Guidance). Once finalized, the IDTA will replace the Old SCCs in the UK. The New SCCs do not apply in the UK. As such, Khoros will continue to rely on the Old SCCs for UK Customers until the UK publishes its IDTA. Khoros will update its agreements and documentation once the UK finalizes its IDTA and Guidance.

Khoros Agrees to Be Bound By The New SCCs

If applicable to a particular Customer, Khoros agrees to be bound by the New SCCs. For new Customers, it will enter into the New SCCs as of September 27, 2021, and for existing Customers, it will transition from the Old SCCs to the New SCCs within the transition period, but no later than December 27, 2022.

Neither Section 702 Nor EO 12333 Apply To Khoros’s Data Transfers

Khoros, in consultation with its Legal Department, Data Protection Officer, and outside counsel, has determined that Section 702 and EO 12333 do not practically apply to its data transfers. First, Khoros does not provide internet backbone services. Second, the personal data Khoros processes is highly unlikely to be relevant to the foreign intelligence or surveillance activities governed by Section 702 and EO 12333 given that Khoros processes public data and data relating to consumer interactions with consumer brands. To underscore these points, Khoros has never received a FISA or EO 12333 request. That said, even though Khoros deems Section 702 and EO 12333 almost irrelevant to our business, we have, nonetheless, chosen to provide supplementary measures technical and organization measures to protect our data transfers.

Supplementary Measures Khoros Uses Alongside SCCs To Protect EU Personal Information