Lattice's Approach to EU Data Transfer Compliance

·Lattice's Approach to EU Data Transfer Compliance

·Last Updated: 23 December 2024 At Lattice, we deliver best-in-class performance management and HRIS software to some of the most demanding human resources and people operations teams in the world. We understand that compliance is not an option, and that for many of our product ambassadors, platform administrators, and loyal users, their jobs depend on our continued compliance with our regulatory obligations. With this in mind, Lattice constantly monitors the regulatory landscape for new developments and compliance best practices, including the practical effects of decisions from Europe's highest court, the European Court of Justice (CJEU), on international data transfers from the EU.

·We know that some of our customers have questions about how the ruling affects their use of Lattice products. The purpose of this page is to address those questions.

·What did the CJEU decide regarding data transfers from the EU?

·On 16 July 2020, in a landmark decision (Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems, "Schrems II"), the CJEU invalidated the EU-US Privacy Shield Framework, one of the more common international transfer mechanisms relied upon by US companies to receive EU data. At the same time, the court upheld the validity of the Standard Contractual Clauses ("SCCs"), another common transfer mechanism.

·However, while the SCCs continue to provide a valid transfer mechanism to transfer personal data out of the EU, the CJEU further explained that the data importer and data exporter may, in addition to the SCCs, need to agree appropriate supplemental measures (also referred to as "additional safeguards") to ensure an adequate level of protection for the transferred data in light of national security laws that may conflict with any such guarantees provided under the SCCs. The CJEU did not specify what these additional safeguards may entail, leaving much uncertainty in the legal landscape.

·The court observed that as a whole, US law provides greater protections than EU laws in the area of redress for unlawful governmental processing of personal data, but for two problematic investigatory tools, Executive Order 12333 and the Foreign Intelligence Surveillance Act ("FISA") § 702, both of which grant US governmental agencies broad access to data outside of the narrow data processing requirements of the GDPR. Accordingly, there is no procedural action (contractual, regulatory, or otherwise) that can completely remedy the conundrum.

·How Risky are Transfers of Data Pursuant to the SCCs for Lattice's Processing Operations?

·Although it is ultimately for our customers (as the data exporters) to make this determination, in Lattice's view, transfers of EU customer data to Lattice in the United States should be regarded as low risk.

·A US Department of Commerce White Paper provides a detailed explanation of US privacy law as it relates to government access to data, which Lattice customers can, in combination with the information provided on this page, use to independently complete their assessment of the data transfers it makes to Lattice and to reach the determination they need to make about Lattice as their US data processor.

·To summarize some of the helpful commentary provided in the White Paper:

·● Most US companies do not deal in data of any interest to the US intelligence agencies. Companies whose EU operations involve ordinary commercial products or services, and whose EU-US transfers of personal data involve ordinary commercial information like employee, customer, or sales records, would have no basis to believe US intelligence agencies would seek to collect that data. Accordingly, Lattice has no basis to believe that US intelligence agencies would seek to collect its data.

·● Parties to commercial contracts may undertake independent protective actions and corresponding analysis to ensure compliance with the GDPR. Several specific mechanisms are offered as examples.

·What Actions Has Lattice Taken to Comply with International Data Transfer Requirements Under the GDPR in Light of Schrems II?

·Since the ruling, Lattice has implemented a number of measures that aim to ensure an adequate level of protection for European data our customers transfer to Lattice for processing in the United States and to ensure minimal disruption to our customers.

·Specifically, Lattice has implemented the following measures:

·● In addition to incorporating the SCCs, our customer Data Processing Addendum enumerates our commitments to security, confidentiality of processing, limitations on international transfers of personal data, cooperation with data subject rights, notice of security incidents, and more.

·● We have updated our DPA to provide greater contractual protections against law enforcement requests. In particular, Lattice contractually commits to redirect to the customer any government requests for their data (e.g., EO 12333 or FISA § 702 orders), and commits to providing advance written notice of any compulsory requests to access their data, unless prohibited by law from doing so.

·● We maintain a robust security and privacy program that addresses the management of security and security controls employed by Lattice. The following is a summary of some of the important and specific technical and organizational measures we have implemented (and will continue to implement) to safeguard against unauthorized access to our customers' data:

·(1) Encryption: Lattice commits to protect the confidentiality of its customer data, in transit and at rest, using the most secure forms of encryption available, including SSH, TLS, and encryption and hashing protocols approved by NIST.

·(2) Access controls: Lattice restricts third-party access to its internal tooling and infrastructure. Our Legal, Security, and Privacy teams evaluate all requests for access, ensure that the request is appropriate for the work to be performed, and confirm that the third-party follows all security and privacy provisions outlined in its contract. Once approved, Lattice only grants access through controlled accounts to clearly-defined portions of the system.

·● Lattice does not sell, rent, or trade customers' personal data. When Lattice accesses data hosted in the EU, it is in service to our customers, such as to provide technical support for their most critical issues, to deliver the right security solutions, or to optimize their experience in utilizing the Lattice product.

·Lattice's executive leadership will continue to embrace, support, and endorse the policies and recommendations proposed by its Information Security Management System (ISMS) Committee, including the regular review and assessment of all security systems and policies to ensure they meet or exceed industry best practices.

·Is Lattice Participating in the EU-US Data Privacy Framework?

·No, Lattice has chosen not to pursue certification under the EU-US Data Privacy Framework at this time. Our decision is based on several considerations:

·● Standard Contractual Clauses ("SCCs"): Lattice employs SCCs as our primary mechanism for international data transfers. These clauses are a well-established and widely used method for ensuring data protection and compliance with EU privacy standards, and they align well with our commitment to maintaining high data protection standards. The European Commission has confirmed that SCCs remain an approved transfer mechanism for data transfers.

·● Potential judicial challenges: We recognize that new frameworks such as the EU-US Data Privacy Framework may face judicial scrutiny and potential challenges. Given the history of legal challenges to previous frameworks, we are taking a cautious approach. By relying on SCCs, we ensure continued compliance and stability in our data transfer activities without the uncertainty that might arise from potential legal disputes over the new framework.

·We continuously monitor developments in international data transfer mechanisms and legal frameworks. If the EU-US Data Privacy Framework proves to be a stable and advantageous option in the future, we may reconsider our position. Our primary objective is to ensure the highest standards of data protection, reliability, and compliance with all applicable regulations.

·We Welcome Your Questions.

·If you have any questions,, please contact us at privacy@lattice.com.