The Portuguese DPA ordered the National Institute of Statistics (INE) to suspend the transfer of data gathered in the context of the Census 2021 questionnaire to third countries that do not ensure an adequate level of protection
The INE employed Cloudfare as a content delivery network (proxy server between the user’s browser and the server of the INE), meaning that all the information can be distributed to Cloudfare servers distributed also in countries that do not provide an adequate level of protection (including China, India, and Russia).
As Cloudfare is located in the USA and due to the type of services it provides, it is subject to the US surveillance legislation for national security. They must hand over the information to the US authorities if requested.
Considering the extent of the individuals affected (all Portuguese citizens residing in the country) and the type of data (including special categories: health and religion data), the PT DPA ordered the almost immediate suspension of any transfer to the US or any other third country without adequate protection.
This was so, even where the transfers were based on SCCs, because there were no additional guarantees that such SCC may be complied within the third country
0 comentarios