• PDF

US Sanctions List Screening – a European Data Protection Issue?

Opinnäytetyöt 1.6.2021, Gradut ja muut tutkielmat

For decades, there has been tension between extraterritorial legislation of the United States of America (US) and the aims of the European Union (EU). In particular, the extraterritorial effect of economic sanctions imposed by the US and the EU’s attempts of blocking such extraterritorial effect have left European companies in a difficult position. The conflict appears in the context of the General Data Protection Regulation (GDPR), which includes unclarity in regard to whether companies bound by it are allowed to conduct sanctions list screening for compliance with US sanctions. In the current legal state, Finnish law does not allow US sanctions list screening for all companies which US sanctions law apply to, or to the extent US sanctions list screening includes processing of personal data under Article 9 and 10 GDPR.

The goal of this master’s thesis is to identify if EU data protection law permits US sanctions list screening. This question is linked to the permissibility of US sanctions law under customary international law and the compatibility of US sanctions law with the aims and laws of the EU. The personal data that is processed in connection with US sanctions list screening includes personal data under Articles 9 and 10 GDPR. Therefore, much of the focus lies on examining the lawful bases for processing of the mentioned categories of personal data. The primary research method of this thesis is legal dogmatics. Additionally, elements of comparative law are used.

The lawful bases of legitimate interest of the controller and substantial public interest appear to apply as grounds permitting the processing of personal data in connection with US sanctions list screening. The legitimate interest is based on the high risk of penalties for a company that in incompliant with US sanctions law. The substantial public interest consists of the objectives of the EU and the preservation of the international relations between the EU and the US. However, compliance with certain US sanctions measures that are prohibited under Council Regulation (EC) No 2271/96 or highly controversial under customary international law, such as the prohibition of re-exportation of US-origin goods or Title III of the Helms-Burton Act, cannot constitute lawful purposes for processing of personal data. The EU is encouraged to clarify whether the GDPR allows US sanctions list screening.

Asiasanat
• EU-oikeuden soveltaminen - Eurooppaoikeus - Tietosuoja

Linkit
• EPNAs (EU) 2016/679 luonnollisten henkilöiden suojelusta henkilötietojen käsittelyssä sekä näiden tietojen vapaasta liikkuvuudesta ja direktiivin 95/46/EY kumoamisesta (yleinen tietosuoja-asetus) (GDPR) 27.4.2016