international transfers of personal data of its customers,
users, suppliers, employees and other data subjects to
countries outside the European Economic Area (“EEA”)
that have not been declared to have an adequate level of
data protection by the European Commission, either
directly or through third parties. In this context, it is
particularly relevant to have all the necessary legal
controls in place to ensure that such international data
transfers are carried out in accordance with the GDPR.
However, there can be no assurance that the data
transfers which took place under the framework of the
EU-U.S. Privacy Shield did not result in a breach of the
GDPR.
One of the relevant contractual measures to ensure
the lawfulness of international data transfers to any
country outside the EEA not found by the European
Commission to have an adequate level of data protection,
is the signing, between the data importer and the data
exporter, of the new standard contractual clauses
("SCC") approved by the European Commission
according to Implementing Decision (EU) 2021/914 of
June 4, 2021. These new SCC, which entered into force
on June 27, 2021, repeal the old SCC and include a novel
modular set of clauses for their application according to
the data processing role of both the exporter and the
importer. Furthermore, the entry into force of the new
SCC obliges companies that are going to use them to
legitimize their transfers to assess and adopt additional
measures deemed appropriate for the due protection of
the data transferred to the third country. This is because
SCC, in general, are not sufficient for this purpose, as the
public authorities of the third country, in accordance with
their local regulations, may have the power to access or
request access to the data transferred. The additional
measures to be adopted are mainly technical such as
data encryption, and derive in particular from the impact
analysis of each transfer and the country of destination,
all following the guidelines issued by the European Data
Protection Board in its Recommendations 01/2020.
Furthermore, the adoption of the new SCC by the
European Commission as the main legal tool to legitimize
transfers, obliges companies to replace the old SCC, as
the old SCC will cease to be legally valid at the end of
2022 in accordance with the aforementioned
Implementing Decision. The entry into force of the new
SCC and their novel module structure and dispositive
parts to be negotiated between data exporters and
importers, the possible uncertainty about their scope of
application and implementation, the mandatory
assessment and analysis of each international transfer
and changeable local regulations of the country of
destination and also the obligation to renew all
agreements that include the old SCC, pose a challenge
for the Group and, with it, a potential risk of non-
compliance in the performance of international data
transfers in accordance with the GDPR.
In addition, the following recent and prospective
regulatory developments may be material to the
Telefónica Group's operations: (i) in the United Kingdom,
its exit from the European Union on January 1, 2021 means
that the Group must monitor how its operations and
business in the United Kingdom are affected in terms of
applicable privacy regulations and, specifically, the flow
of data to and from the United Kingdom. The European
Commission declared the United Kingdom as a country
with an adequate level of data protection according to
the Adequacy Decision of June 28, 2021. Accordingly,
entities that transfer data between both territories will not
be required to adopt additional tools or measures to
legitimize international transfers. The Adequacy Decision
establishes an initial period of validity of four years, which
may only be extended if the United Kingdom
demonstrates that it continues to ensure an adequate
level of data protection. In this regard, it is worth
mentioning that, since European Union regulations no
longer apply in the United Kingdom, in September 2021,
the United Kingdom began the appropriate public
consultations to analyze the modification of its local
privacy and data protection regulations with a view to
updating them in the face of new technological
challenges and business opportunities in the use of data.
The result of this amendment could impact the
Telefónica Group's business in the United Kingdom and
the aforementioned international data transfers to and
from the United Kingdom, either because additional
regulatory restrictions or impositions are imposed that
reduce the capacity for innovation and the development
of new services and products, or because the European
Union authorities consider that the United Kingdom is no
longer a country with an adequate level of data
protection, in which case the Telefónica Group may face
similar challenges and risks as it is currently facing with
respect to data transfers to the United States or other
territories not declared as having an adequate level of
protection; and (ii) in Latin America, Law No. 13,709 in
Brazil imposes standards and obligations similar to those
required by the GDPR, including a sanctioning regime
which is in force from August 2021, with fines for non-
compliance of up to 2% of the Group's income in Brazil in
the last financial year subject to a limit of 50 million
Brazilian reais (approximately 8 million euros based on the
exchange rate as of December 31, 2021) per infraction,
which may increase compliance risks and costs.
Furthermore, in the case of Ecuador, the Organic
Law on Data Protection has entered into force, although
the effectiveness of the sanctioning regime is postponed
for a two-year adaptation period and, in other countries
of Latin America where the Group operates, such as
Argentina and Chile, there are regulatory proposals to
bring regulation more in line with the provisions set forth
in the GDPR, which may increase compliance risks and
costs.
Data privacy protection requires careful design of
products and services, as well as robust internal
procedures and rules that can be adapted to regulatory
changes where necessary, all of which entails
compliance risk. Failure to maintain adequate data
security and to comply with any relevant legal