Since you can only setup Slack data residency in EU on the most expensive plans, is it ok to use their service still under GDPR rules without that option? Would signing a DPA stating they are compliant would be enough?
2
-
1What is "Slack data residency"?– ohwillekeFeb 24, 2022 at 20:37
-
1@ohwilleke Slack data residency lets a Slack customer on a Business+ or Enterprise plan select the data center in which user data for the Slack space is kept. The available locations include EU data centers, which avoids GDPR issues about international data transfers (if we ignore the problems posed by the US Cloud Act).– amonFeb 24, 2022 at 22:29
Add a comment
|
1 Answer
When you are the data controller, and are transferring data under your control into non-European countries, you need to protect that transfer. Slack proposes that you use the “standard contractual clauses” (SCCs) mechanism, which is incorporated into their DPA. To enter into SCCs, you as the controller must be convinced that the data importer on the other end is also able to enter into these SCCs. This cannot be the case if the data importer is subject to non-European laws that could require disclosure without legal basis.
In the Schrems II judgement, the partial adequacy decision for the United States was invalidated. SCCs can still be a valid transfer tool. However, exactly the same reasons that invalidated the adequacy decision also call into question whether US-based companies can enter into SCCs: electronic communications services can be compelled to disclose personal data to US intelligence agencies without suitable options for redress by the data subjects. Slack is such an US-based company that is probably within scope of these spy laws.
If no sufficient legal protections are available, SCCs might still be permissible by implementing supplemental measures that effectively prevent access to the personal data by US intelligence agencies, such as end to end encryption with keys that never leave Europe. The EDPB has issued recommendations on such measures. However, such technical measures are generally incompatible with SaaS services such as Slack.
Thus, you must perform an analysis of the available legal and technical measures:
- If you find that Slack is subject to relevant US laws and that you cannot implement supplemental measures, then the data transfer is probably illegal.
- Otherwise, a transfer based on SCCs combined with suitable supplemental measures might be legal.
In this answer, “Europe” means the UK for the UK GDPR, and EU/EEA for the EU GDPR.
