[Legal Notice] Google Cloud Platform Data Processing and Security Terms updated to address the invalidation of EU-US Privacy Shield

We are writing to inform you of changes we’ve made to the Google Cloud Platform (GCP) Data Processing and Security Terms (Customers) and Google Cloud Platform (GCP) Data Processing and Security Terms (Partners) (together, the DPST) in response to a Court of Justice of the European Union (CJEU) ruling on July 16, 2020. The CJEU ruling invalidated the EU-US Privacy Shield Framework but did not invalidate EU Model Contract Clauses (MCCs, also known as Standard Contractual Clauses) as a lawful transfer mechanism for personal data transferred outside of the EU, Switzerland or the UK (as applicable).

What do I need to know?

If the EU’s General Data Protection Regulation or equivalent legislation in Switzerland or the UK (collectively, the GDPR) applies to your GCP usage, and you have not previously accepted the MCCs in the Cloud Console, the updated DPST automatically deem the MCCs to apply.

What do I need to do?

No action is required on your part if:

• The GDPR does not apply to your use of GCP, since these changes will then have no practical impact;
• You have already accepted the MCCs in the Cloud Console, since they will continue to apply;
• You are a GCP customer and your Google Cloud Platform agreement incorporates Google’s current DPST (for example, an offline Cloud Master Agreement or the online Google Cloud Platform Terms of Service); or
• You are a GCP partner, since the updated Partner DPST will automatically apply.

Otherwise, we recommend that, you opt in to the updated DPST in the Cloud Console if:

• The GDPR applies to your GCP usage; and
• Your Google Cloud Platform agreement does not incorporate the DPST.

We also recommend that, if you are a GCP partner whose customers are subject to the GDPR, and you have not yet entered into appropriate terms (for example, based on MCCs) with those customers to legitimize the transfer of their personal data in compliance with the GDPR, you consult with your legal advisors and consider doing so.

If you are not the right person to review the updated DPST or this notice, please forward this notice to the appropriate contact for your organization, such as your legal or compliance team.

Need more assistance?

If you have further questions, you can refer to the Google Cloud blog post or contact Google’s Cloud Data Protection Team, mentioning the subject of this email in the ‘Description’ field.

Thanks for choosing Google Cloud.

Was this information helpful?
YES   NO