Mailchimp as a company is probably mostly GDPR-compliant. But this doesn't mean that using the Mailchimp service would be compliant as well.
This is because the GDPR has different compliance obligations for “data controllers” and “data processors”. The data controller is responsible for the compliance of all processing activities they determine the purposes and means for, regardless of whether those activities are actually outsourced. In contrast, the primary responsibility of a data processor is to only use the data as instructed by the controller, but not for the processor's own purposes.
So Mailchimp probably doesn't abuse its customer's data, and offers an Art 28 GDPR conformant data processing agreement as part of its contracts. Mailchimp also offers features that assist with related privacy laws, such as collecting proper consent as required by the EU ePrivacy Directive.
And Mailchimp has a page about European data transfers. This is where it gets tricky. Not the Mailchimp service, but the customer is the data exporter / data controller and is responsible for compliance with Chapter V of the GDPR. The data controller must decide themselves whether the international transfer into the US is legal. Briefly, the GDPR allows the following grounds for an international transfer of personal data:
- target country has an adequacy decision from the EU – no, because the EU–US Privacy Shield was invalidated in the Schrems II ruling
- Standard Contractual Clauses (SCCs) – maybe, see below discussion
- Binding Corporate Rules – not applicable
- exceptions, including explicit consent or only occasional transfers – not applicable
The Mailchimp guide about EU data transfers correctly states that the Schrems II decision only invalidated the Privacy Shield, and did not invalidate the concept of SCCs. That means it is still legal to use SCCs as a basis to transfer personal data in non-EU countries. But this doesn't imply that SCCs can serve as a basis for transferring personal data specifically to Mailchimp in the US – a case by case analysis is necessary that determines whether security of processing is guaranteed and whether data subjects would have effective legal remedies if their rights were breached.
It now happens that exactly the same reasons that caused the Privacy Shield to be invalid must also make us doubt whether SCCs can be valid in their place. The problem with transfers to the US never was the risk that the recipient would sell the personal data to the highest bidder, but that the US-based company is subject to US spy laws like FISA 702 and EO 12333 that do not provide effective legal remedies for foreign affected persons. (Mailchimp explicitly confirms that it is subject to those spy laws as an “electronic communication service”.)
In the wake of the Schrems II ruling the EDPB has published a document with recommendations for supplemental safeguards that could make SCCs permissible, but these recommendations (like end to end encryption, or only transferring pseudoymized data) cannot work for US-based cloud services such as Mailchimp. Some (such as the US government) have argued that Schrems II was based on outdated information, but this standpoint is not shared by European regulators.
So, the data controller – the Mailchimp customer – has to make their own judgement about this international transfer.
If SCCs combined with Mailchimp's supplemental measures provide sufficient safeguards, then the international transfer is legal and GDPR-compliant. Mailchimp offers all the necessary paperwork such as DPAs, SCCs, and so on.
If there are no sufficient safeguards, then the transfer is clearly illegal.
My personal opinion is that Mailchimp's supplemental measure fall far short of what would be required per the EDPB recommendations. Lower courts in the EU now routinely consider all transfers to the US as illegal. A company using Mailchimp was also an early target of a post-Schrems II enforcement action, though it wasn't fined since it immediately stopped using the service.
So while it's not possible to definitely say that using Mailchimp would be a GDPR-violation, it's very difficult to argue that such use could be compliant.
