Belgian Council of State Considers Encryption a Sufficient Measure for U.S. Data Transfers
The Belgian Council of State recently confirmed a decision of the regional Flemish Authorities to contract with an EU branch of a U.S. company using Amazon Web Services, stating that the use of U.S. cloud services in itself does not infringe on the GDPR.
The decision was made in the context of a tender granted by the Flemish Authorities to a company that used AWS cloud services. An unsuccessful tender participant had challenged the outcome of the tender process before the Council of State, deploying several arguments, including that a lack of appropriate safeguards for data transfers to AWS in the U.S. infringed the GDPR’s restrictions on data transfers in light of the judgment of the Court of Justice of the European Union (“CJEU”) in the Schrems II case.
