The CNPD has ordered to INE to suspend the invite of data of the census to USA.
The CNPD has emitted today a decision addressed to INE to suspend within 12 houses any international transferences of personal data in USA o in other countries without an adequate protection level, in the filed of investigation of the 2021 census.
After some complainants on the conditions for the recollection of data of the Census by internet, CNPD has carried out a fast investigation which has concluded that INE has addressed to Cloudflare Inc. for the operativity of the census investigation, which provides in its own contract the transference of personal data into the USA.
Cloudflare is a company with the registered office in California. For the type of services that provides, is directly proportionated to the supervisory legislation of USA for national security purposes, which imposes the legal obligation to provide to USA authorities the illimited access to personal data that you have or watch over, without you being able to inform your clients.
The European Court of Justice has recently considered, in the famous sentence Scherms II, that this legislation implies a disproportionate interference into fundamental rights of data subjects, in the light of the European rights, and so does not guarantee a balanced data protection level compared to those one into the European Union.
The court has considered that the personal data protection authorities are obliged to suspend or prohibit the personal data processing, even if on contract based on the model approved by the European Commission, like in case of the clauses subscribed by INE, if there are not guarantees that those can be respected in the third countries.
Keeping in mind that are involved personal data which came from a universe which is made by citizens which are resident into the national territory, including sensible data like those one concerned the religion or the health conditions, the CNPD has thoughts that the data transference in USA or in any other countries without an adequate protection.
Today, and according to information available by INE, have been obtained responses to the Census for more than 6,5 million data subjects. The recollection of personal data started 8 days ago, and it will end on the 3rd of May.