The essentials
- A request to a third-party server sends the visitor's IP address: outside the EEA, Chapter V GDPR applies.
- US recipients certified under the EU-US Data Privacy Framework rely on the 2023 adequacy decision.
- Others need another mechanism, typically Standard Contractual Clauses with an assessment.
Why a request is a transfer
When a browser fetches a script, a pixel or a font from another company's server, that server receives the visitor's IP address and often other identifiers. If the recipient is established outside the European Economic Area, Chapter V of the GDPR applies to that transfer.
Visitor in the EUbrowser
GET page
Your websiteEU
IP + identifiers
Third partyUnited States
Each third-party request is a transfer to the recipient's country. Is it certified under the Data Privacy Framework? If not, which safeguard applies?
What changed in 2020 and 2023
- In July 2020 the Court of Justice of the EU invalidated the EU-US Privacy Shield (Schrems II, C-311/18) and required an assessment of the destination country when relying on Standard Contractual Clauses.
- On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. Transfers to US companies certified under it rely on that decision; others still need another mechanism, typically Standard Contractual Clauses with an assessment.
What to check for each third party
- Who receives the data, and where it is established.
- For a US recipient, whether it is listed as certified on the Data Privacy Framework list.
- Whether the purpose needs consent first (see section 25 TDDDG), and whether the service could be replaced or hosted in the EU.
- That the vendor, its purpose and the transfer appear in your record of processing.
Checklist
- Every third party listed with the country where its recipient is established.
- US recipients checked against the Data Privacy Framework list (certification can lapse).
- Standard Contractual Clauses and a transfer assessment for the others.
- Consent obtained first where the purpose requires it.
- Transfers documented in the record of processing (Art. 30 GDPR).
Sources
- Chapter V GDPR (Articles 44 to 49).
- CJEU, 16 July 2020, Data Protection Commissioner v Facebook Ireland and Schrems, C-311/18.
- Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US Data Privacy Framework).
- Commission Implementing Decision (EU) 2021/914 (Standard Contractual Clauses).
General information, not legal advice. Have your specific situation reviewed by your DPO or counsel.