This Annex 1 to Exhibit 3 (the “Annex”) provides additional safeguards and redress to the Data Subjects whose Customer Personal Data is transferred to Huble pursuant to the EU 2021 SCCs. This Annex supplements and is made part of, but is not in variation or modification of the EU 2021 SCCs.
- Applicability of this Annex
- This Annex only applies with respect to Restricted International Transfers when the EU 2021 SCCs apply to such Restricted International Transfers pursuant to this Addendum and its exhibits.
- Definitions
- For the purpose of interpreting this Annex, the following terms shall have the meanings set out below:
- “Data Importer” and “Data Exporter” shall have the same meaning assigned to them in Exhibit 1, read with Exhibit 3.
- “Disclosure Request” means any request from law enforcement authority or other governmental authority with competent authority and jurisdiction over the Data Importer for disclosure of Customer Personal Data processed under this DPA
- “EO 12333” means the U.S. Executive Order 12333.
- “FISA” means the U.S. Foreign Intelligence Surveillance Act.
- “Restricted International Transfers” means a Restricted Transfer of EEA Personal Data or a Restricted Transfer of UK Personal Data, as defined in Exhibit 3.
- “Schrems II Judgment” means the judgment of the European Court of Justice in Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximilian Schrems.
- Applicability of Surveillance Laws to Data Importer and its Contracted Processors
- U.S Surveillance Laws
- Data Importer represents and warrants that, as of the effective date of this DPA, it has not received any national security orders of the type described in Paragraphs 150-202 of the Schrems II judgment.
- Data Importer represents that it reasonably believes that it is not eligible to be required to provide information, facilities, or assistance of any type under FISA Section 702 because:
- No court has found Data Importer to be an entity eligible to receive legal process issued under FISA Section 702: (i) an “electronic communication service provider” within the meaning of 50 U.S.C. § 1881(b)(4); or (ii) an entity belonging to any of the categories of entities described within that definition.
- If Data Importer were to be found eligible for process under FISA Section 702, which it believes it is not, it is nevertheless also not the type of provider that is eligible to be subject to UPSTREAM collection pursuant to FISA Section 702, as described in paragraphs 62 and 179 of the Schrems II judgment.
- EO 12333 does not provide the U.S. government the ability to order or demand that Data Importer provide assistance for the bulk collection of information and Data Importer shall take no action pursuant to U.S. Executive Order 12333.
- General provisions about surveillance laws applicable to Data Importer
- The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination of Customer Personal Data applicable to the Processing of Customer Personal Data by Data Importer, including any requirements to disclose Customer Personal Data or measures authorizing access by public authorities, prevent Data Importer from fulfilling its obligations under the EU 2021 SCCs (where applicable).
- Data Importer shall monitor any legal or policy developments that might lead to its inability to comply with its obligations under the EU 2021 SCCs and this Annex, and promptly inform Data Exporter of any such changes and developments. When possible, Data Exporter shall inform Data Exporter of any such changes and developments ahead of their implementation.
- Obligation on Data Importer Related to Disclosure Requests
- In the event Data Importer receives a Disclosure Request, Data Importer shall:
- Promptly (and, when possible, before disclosing the transferred Customer Personal Data to the public authority) notify Data Exporter of the Disclosure Request, and, where possible, the Data Subject, unless prohibited by law, or, if so prohibited from notifying Data Exporter, use all lawful efforts to obtain the right to waive the prohibition to communicate information relating to the Disclosure Request to Data Exporter as soon as possible. This includes, but is not limited to, informing the requesting public authority of the incompatibility of the Disclosure Request with the safeguards contained in the EU 2021 SCCs and the resulting conflict of obligations for Data Importer and documenting this communication.
- Ask the public authority that issued the Disclosure Request to redirect its request to the Data Exporter to control conduct of the disclosure.
- Use all lawful efforts to challenge the Disclosure Request on the basis of any legal deficiencies under the laws of the requesting party or any relevant conflicts with the law of the European Union or applicable EEA Member State law or any other Data Protection Laws and demand that the public authority aims to obtain such information via co-operation with government bodies in each jurisdiction (such as using an alternative established treaty or mechanism to allow government-government sharing of information).
- Seek interim measures with a view to suspend the effects of the Disclosure Request until a competent court has decided on the merits.
- Not disclose the requested Customer Personal Data until required to do so under the applicable procedural rules.
- Provide the minimum amount of information permissible when responding to the request, based on a reasonable interpretation of the request.
- Document all the steps taken by Data Importer related to the Disclosure Request.
- For the purposes of this Section, lawful efforts do not include actions that would result in civil or criminal penalty such as contempt of court under the laws of the relevant jurisdiction.
- Information on Requests for Personal Data by Public Authorities
- Data Importer commits to provide Data Exporter with sufficiently detailed information on all requests for Personal Data by public authorities which Data Importer has received over a specified period of time (if any), in particular in the areas of intelligence, law enforcement, administrative, and regulatory supervision applicable to the transferred data and comprising information about the requests received, the data requested, the requesting body, and the legal basis for disclosure and to what extent Data Importer has disclosed the requested Personal Data. Data Importer may choose the means to provide this information.
- Backdoors
- Data Importer certifies that:
- It has not purposefully created backdoors or similar programming for governmental agencies that could be used to access Data Importer’s systems or Customer Personal Data subject to the EU 2021 SCCs.
- It has not purposefully created or changed its business processes in a manner that facilitates governmental access to Customer Personal Data or systems.
- National law or government policy does not require Data Importer to create or maintain back doors or to facilitate access to Customer Personal Data or systems.
- Data Exporter will be entitled to terminate the contract upon 30 days’ prior written notice to the Data Importer in cases in which Data Importer does not reveal the existence of a back door or similar programming or manipulated business processes or any requirement to implement any of these or fails to promptly inform Data Exporter once their existence comes to its knowledge.
- Information About Legal Prohibitions
- Data Importer will provide Data Exporter information about the legal prohibitions on Data Importer to provide information under this Annex. Data Importer may choose the means to provide this information.
- Additional Measures to Prevent Authorities from Accessing Customer Personal Data
- Notwithstanding the application of the security measures set forth in this DPA, Data Importer will implement the following technical, organizational, administrative, and physical measures designed to protect the transferred Customer Personal Data:
- Encryption of the transferred Customer Personal Data in transit using the Transport Layer Security (TLS) protocol version 1.2 or higher with a minimum of 128-bit encryption;
- Encryption at rest within software applications used by Data Importer using a minimum of AES-256;
- Active monitoring and logging of network and database activity for potential security events, including intrusion;
- Regular scanning and monitoring of any unauthorized software applications and IT systems for vulnerabilities of Data Importer;
- Restriction of physical and logical access to IT systems that Process transferred Customer Personal Data to those officially authorized persons with an identified need for such access;
- Firewall protection of external points of connectivity in Data Importer’s network architecture;
- Expedited patching of known exploitable vulnerabilities in the software applications and IT systems used by Data Importer; and
- Internal policies establishing that:
- Where Data Importer is prohibited by law from notifying Data Exporter or the Data Subject of a request or order from a public authority for transferred Customer Personal Data, Data Importer shall take into account the laws of other jurisdictions and use best efforts to request that any confidentiality requirements be waived to enable it to notify the competent supervisory authorities;
- Data Importer must require an official, signed document issued pursuant to the applicable laws of the requesting third party before it will consider a request for access to transferred Customer Personal Data;
- Data Importer shall scrutinize every request for legal validity and, as part of that procedure, will reject any request Data Importer considers to be invalid;
- If Data Importer is legally required to comply with an order, it will respond as narrowly as possible to the specific request; and
- If Data Importer receives a request from public authorities to cooperate on a voluntary basis, Customer Personal Data transmitted in plain text may only be provided to public authorities with the express agreement of Data Exporter.
- Inability to Comply with this Annex and the EU 2021 SCCs
- If Data Importer determines that it is no longer able to comply with its contractual commitments under this Annex, Data Exporter can swiftly suspend the transfer of Customer Personal Data and/or terminate the Principal Agreement upon 30 days prior written notice.
- If Data Importer determines that it is no longer able to comply with the EU 2021 SCCs or this Annex, Data Importer shall return or delete the Customer Personal Data received in reliance with the EU 2021 SCCs. If returning or deleting the Customer Personal Data received is not possible, Data Importer must securely encrypt the data without necessarily waiting for Data Exporter’s instructions.
- Data Importer shall provide the Data Exporter with sufficient indications to exercise its duty to suspend or end the transfer of Customer Personal Data and/or terminate the contract upon 30 days’ prior written notice.
- Termination
This Annex shall automatically terminate with respect to the Processing of Customer Personal Data transferred in reliance of the EU 2021 SCCs if the European Commission or a competent regulator approves a different transfer mechanism that would be applicable to the Restricted International Transfers covered by the EU 2021 SCCs (and if such mechanism applies only to some of the data transfers, this Annex will terminate only with respect to those transfers) and that does not require the additional safeguards set forth in this Annex.