On 16 July 2020 the European Court of Justice (CJEU) determined that the Privacy Shield Framework—the framework agreed between the European Union (EU) and the US for the transfer of personal data to the US—was invalid. We realise that this may give some of our customers cause for concern and so we wanted to address this with you.
Although SurveyMonkey has certified under Privacy Shield, we have also, for several years, offered many of our customers the alternative of applying Standard Contractual Clauses (SCCs) to their account. These Standard Contractual Clauses are a set of contract clauses established by the European Commission to legitimise and govern data transfers out of Europe to third countries and they have not been invalidated by the decision of the CJEU.
Enterprise customers do not need to take any action as we automatically apply SCCs within our MSA terms. For all our self-service customers you can now apply for our Data Processing Agreement with SCCs in light of the above decision. We will take several actions to ensure your data is transferred in accordance with legal obligations. We will work with our legal team and Data Protection Officer and monitor closely the guidance that comes from our legal supervisory authority in Ireland. This will help us determine the future impact of the court's decision as well as define any further future steps to take.
The decision on Privacy Shield is just a first step in hopefully establishing more stringent and careful protections for personal data transfers outside the EU. SurveyMonkey will aim to follow all developments and ensure we stay astride the changes required under GDPR and EU law.
