, ,

Data transfers: Investigations begin after Schrems II ruling

The Schrems II ruling raised a big fuss in the summer of 2020: with the invalidation of the Privacy Shield, companies are now required to carry out a detailed assessment to verify the adequacy of the legal regime of the states to which they transfer processed personal data, compared to the guarantees offered by the GDPR. This position was first affirmed by the CJEU and then confirmed by the European Data Protection Board. The data transfer assessment is legally and technically complex, but necessary, and only few – virtuous – companies have implemented a methodology to handle such requirement. In the meantime, the first investigations by the Data Protection Authorities have started, will EU companies be ready?

1. The effect of the Schrems II judgment

The Schrems II ruling by the Court of Justice of the European Union (CJEU), issued on July 16, 2020, invalidated the EU-US Privacy Shield and created new obligations, particularly for companies transferring personal data under standard contractual clauses (SCCs). On November 10, 2020, the European Data Protection Board (EDPB) published recommendations on steps companies can take to supplement transfer instruments, such as SCCs, to ensure compliance with EU data protection law. These recommendations established strict criteria for the use of standard contractual clauses as an alternative mechanism for transferring data outside the European Economic Area, requiring companies to make a case-by-case assessment of the appropriateness of such a transfer.

2. New standard contract clauses will not be enough

On November 12, 2020, the European Commission published a draft implementing decision on standard contractual clauses for the transfer of personal data to third countries under the GDPR, making public the draft set of new standard contractual clauses (the “SCCs”). The draft standard contractual clauses will govern transfers of personal data outside the European Economic Area (EEA) to replace the current SCCs, taking into account changes introduced not only through the GDPR but also by the Schrems II ruling, and to better reflect the widespread use of new and more complex processing operations that often involve multiple data importers and exporters. Subsequently, in January 2021, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) published a joint opinion on the new standard contract clauses. EDPB and EDPS have welcomed the new SCCs, but have asked for several changes to be adopted. Apparently, the requested changes are numerous and relate to, among other things, the so-called “docking clause” that allows additional parties to join the SCCs and the obligations of data controllers. In addition, the EDPB and EDPS suggest that the annexes to the SCCs clarify as much as possible the roles and responsibilities of each party with respect to each processing activity, because any ambiguity would make it more difficult for controllers or processors to fulfill their obligations under the accountability principle.

The new SCCs do not resolve the issues regarding data transfers outside the EEA generated by the Schrems II ruling. In fact, both the EDPB and EDPS indicate that, with respect to specific transfers of personal data to third countries, the additional measures outlined in the EDPB’s recommendations may be necessary. Therefore it remains essential to perform a transfer impact assessment in relation to any transfer of personal data outside the EEA as reiterated by the EDPB and CJEU.

3. Data Protection Authorities investigations have started

The Swedish Data Protection Authority has issued a sanction under the GDPR for failing to adequately protect sensitive data stored on a U.S. cloud platform following the Schrems II ruling. Specifically, the authority found that Umeå University had processed special categories of personal data relating to sexual life and health through, among others, storage in a cloud service of a U.S. provider, without sufficiently protecting the data.

The decision is relevant because the Swedish authority refers to the Schrems II judgment, arguing that a data transfer to the United States is in itself likely to trigger a high risk to personal data because data subjects are subject to limited safeguards with respect to the protection of their personal data and the exercise of their privacy rights.

Most recently, the Hamburg Data Protection Authority sent out a questionnaire to German organizations with reference to personal data transfers while using Microsoft Office 365. Specifically, the authority is asking companies to disclose details about how they handle data transfers in light of the Schrems II decision, including specific reference to the legal basis for transfers and the use of standard contractual clauses.

It seems clear that there is a strong probability that also the Italian Garante will begin very shortly to ask for evidence of the evaluations on the adequacy of transfers carried out under the Schrems II Judgment and the Recommendations of the European Data Protection Board.

4. A quick solution to assess the data transfer adequacy

In quick response to the Schrems 2 decision, our global data protection team created a pioneering data transfer assessment methodology implemented through a legal tech tool, known as Transfer, which was launched to the market on 28 July 2020.

Transfer helps data exporters and importers to logically assess the safeguards available when transferring data to particular third countries and whether they are adequate.  It includes a five step assessment process, comprising a scoring matrix and weighted assessment criteria to help manage efficient decision making.  The process is facilitated by an interactive LegalTech tool which automates risk scoring and assists in reaching a justifiable decision on how to proceed with a proposed data transfer.

The output is an assessment consistent with the judgment when relying on SCCs or other transfer mechanisms, which is designed to provide an auditable report in line with the GDPR’s accountability principle.

If you wish to know more about Transfer, schedule a demo and learn how to automatize Data Transfer Assessments limiting the risk of sanction, contact me/.

Image courtesy by Lelia Adolphsen

, ,

Innovazione Legale: webinar su LegalTech & Legal Design

💡𝗜𝗻𝗻𝗼𝘃𝗮𝘇𝗶𝗼𝗻𝗲 𝗟𝗲𝗴𝗮𝗹𝗲: #LegalTech & #LegalDesign. Quale sarà il futuro della nostra professione?

Il #webinar definitivo per passare dalle buzzwords alle applicazioni concrete.

🔸Quali opportunità sono sul tavolo?

🔸Quali strumenti utilizzare per coglierle?

🔸Quali sfide affrontare per stare al passo con l’evoluzione in atto nel mercato legale?

Ne parleremo con giursiti d’impresa Giorgia Vulcano Fausto Tramontin, esponenti del mondo accademico Alessandra Salluce e colleghi che si occupano, come me, di #LegalInnovation quotidianamente Luca Visconti Antonio Ravenna


Venerdì 15 Maggio – Ore 16:00

Come si partecipa?

Iscriviti ora – gratuitamente – al link qui ⬅️

Per restare aggiornato sulla community di giovani innovatori segui > TechnoLawgy Telegram channel <

LegalTech after Covid: predictions for 2020 Q3 & Q4

Law firms and companies’ legal departments are rushing to adopt new technologies and build new legacy systems at such a fast pace that many lawyers and practices are being left behind. The second half of 2020 might be the tipping point of the legal tech industry, also taking into consideration the recent boost to remote working and digital tools brought by the health emergency. We may finally experience changes that will forever transform the practice of law and the delivery of legal services. Here are my LegalTech after Covid predictions for 2020 Q3 & Q4.

LegalTech after covid

1.    The Darwinian dilemma “evolutions vs. extinction”

The legal sector is preparing for a significant transformation. Increasing client demands, information complexity, and technology advancements are pressing attorneys to master technical skills and adopt new and powerful tools for the benefit of clients.

Artificial intelligence, algorithms, machine learning, and human-machine interaction are just a few of the new realities that the legal profession is facing. While the advent of new technologies with a highly disruptive effect can sometimes be perceived as a constraint, at the same time it is also a tremendous opportunity for lawyers.

The success of “alternative legal service providers” (i.e., legal services that are delivered via a model that departs from the traditional law firm delivery model, for example, by using contract lawyers, process mapping, or Web-based technology) proves that market expectations are changing and that IT needs to be used to meet new demands.

Using technology in an effective manner in order to deliver efficiencies and increase the potential value added for customers is becoming more relevant as a differentiating factor in winning clients.

LegalTech after covid will move from hype to reality. A growing number of innovative legal service providers will focus on a wide range of inefficiencies, adding value to the legal ecosystem by improving legal and business processes (e.g., the contracting process) and meaningfully integrating legal technology to permit more efficient “data-driven” legal and business workflow management.

To survive, forward-thinking lawyers will need to invent a new way of delivering legal services, focusing on client-centricity by combining legal-design skills to build easy-to-use solutions while ensuring their unbeatable legal competence and professional ethics.

2.    Access to justice will be more and more digitalized 

LegalTech after covid

The legal sector is quickly moving to embrace digital transformation and leaning towards innovation, as the opportunity to improve customer services, drive productivity and achieve interoperability can no longer be ignored. In 2019 investments in legal technology reached unexpected levels worldwide.

At the same time, we are more than far from pointing to an existing taxonomy or the legislative categorization of disciplines within legal tech. Law-making has turned into a fast, digital, innovative process.

To date, law firms and legal professionals are acting at a steady pace and are certainly well ahead on this two-speed journey. Consumers can rely upon a plethora of existing law-tech solutions which promise to increase the accessibility of legal tools to make legal services progressively more affordable to businesses and individuals.

Access to justice in the digital era is indeed marked by increasing creativity. Legal tech tools leveraging technology, data, and user-centered design approaches to develop solutions have widely reached consumers’ needs.

Much work has been carried out to reduce burdens of legal proceedings, and many online dispute resolution platforms will move a step further towards less utopian implementation of virtual courts. These courts enable access to justice without setting foot in a courthouse. Online dispute resolution platforms – where agreements are virtually reached and ratified by courts via an online portal – are already going viral in the UK and US and will sooner or later land in EU.

Time will reveal whether the legal sector is ready to challenge new questions arising from such digital freedom in accessing justice.

3.    Automation will become a timesaver and a risk-mitigator

LegalTech after covid

Automation technologies, based on the combination of machine learning, text processing, and industry statistics to measure the efficiency of specific legal issues, have been slowly adopted by law firms through the years.

In 2020 we will continue witnessing significant growth in the use of practice-management applications among legal professionals. At the same time, we are already seeing these applications changing the trajectory of their development. Narrowly focusing on core practice management, some disruptive new technologies are seeking to become more extensive in order to provide integrated tools and services that should serve as a junction for all functions within a law practice.

AI and Blockchain are already leveraging many years of experience gained in creating legal document templates, and contract management sector has matured significantly. Many legal knowledge fields have been enriched by means of document automation, achieving the solid use of machine learning to analyze, identify, and review legal documents.

But there is more to this. Tools enabling law firms to simplify, through automated solutions, the length, and complexity of the creation process of legal documents will become quite spread globally.

It’s all about optimizing efforts while improving the efficiency and client/attorney relationships within each law firm and improving clients’ intake from the firm. This scenario is already happening, and such phenomenon will most certainly grow, encompassing legal technologies that will snip and fix law firms’ and companies’ needs, by making the same data-driven platforms and services contemporarily available to lawyers and in-house counsels.

New frontiers of the marketplace will meaningfully increase connections between clients and lawyers to raise legal awareness from both sides, to understand and exercise legal rights and obtain successful outcomes. The need for quick and easy legal transactions will become more urgent until self-executing legal agreements finally breakthrough in the legal scene.

The hope is for automation to likely turn into the fingerprint of professional legal services, so as contacts, documents, and files will slowly become more and more cloud-based. Indeed, by moving their infrastructure to a cloud service provider, firms can rest assured that their data is physically secured, backed-up in multiple offsite locations, and most likely protected in case of a violation.

4. Customer-centric legal developement

Undisputedly, legal tech tools are becoming exponentially customer-centric, and this will mark one of the most significant success factors in 2020. Technology-driven tools will significantly provide information and guidance in making legal support quickly available and will expand lawyers’ work through automation and platforms, thus reducing costs and increasing accessibility.

Law firms and corporate legal departments are increasingly experimenting legal tech tools, recognizing the potential of new business models to transform the industry and engage with innovative service providers to develop collaborative solutions for clients.

With no doubt, legal technological solutions will be “epidemic” in Q3&Q4 2020. However, inescapable risks are around the corner, such as the liability of law-tech and AI tools when facing the connatural lack of infallibility.

LegalTech checklist

If you wish to know more about LegalTech applications and use cases, or if you wish to access our Checklist for market-driven LegalTech tools development, please contact me at tommaso.ricci@dlapiper.com.

You may also like this post on #LegalTech: How Legal Technology will disrupt the way lawyers work day by day ?

Get the latest #Privacy and #LegalTech news on > TechnoLawgy Telegram channel <


Tech it easy: LegalTech applied

How Legal Technology will disrupt the way lawyers work day by day

Everybody is talking about LegalTech, but what does it really mean and what is LegalTech applied?

By Alessandro Rubino

The term LegalTech refers to a set of technologies that law firms shall adopt and implement in order to stay up-to-date with the new working schemes of the 2020’s and to be able to support their clients with the ever-growing information technology related legal issues.

Generally speaking “legal technology” refers to a set of tools, ranging from AI based software to document automation programs, used by law firms to improve their internal processes and increase the efficiency and effectiveness of their services.

The first LegalTech applications were designed in the early 2010’s, aiming to assist law firms in acquiring clients, monitoring workflow, restructuring the IT architecture, using online space, the cloud, and speeding up relationships with clients and institutions.

Some of these technologies, mainly software, have helped law firms to better adapt to clients’ needs, enabling them to operate and provide services more efficiently, e.g through remote assistance. In the second decade of 2000, LegalTech applications have considerably expanded through the use of new technologies, such as blockchain and artificial intelligence, or smart contract, identified by many experts as the technologies that will bring unprecedented changes to the legal profession, turning the lawyer into a “tech lawyer”.

The rising technological development which has involved traditional professions, in the form of legaltech, fintech, insurtech, represents an industry trend also at corporate level. Alongside tech boutiques, also in-house companies’ legal departments are experiencing new technological developments and starting to adopt more tech-savvy solutions to speed up business.

Here below we will examine in deep the definition of LegaTech, covering the top 3 key aspects to understand LegalTech applied.

  • The key application fields of legaltech
  • Big Data and Artificial Intelligence use cases
  • LegalTech and lawtech: what is the difference?

1. The key application fields of LegalTech

legaltech applied technolawgy

Based on the experiences so far in Italy and Europe, LegalTech applications can be subdivide in 4 main areas depending on the main assets used:

  1. Law firm management: this is the area in which law tech offers advanced management systems for law firms, such as managing teams and workload;
  2. Practice management: these are the management systems that include applications for practice management;
  3. Practice execution: these are platforms and software that support lawyers in carrying out their specific operations;
  4. Legal services delivery: these are online platforms that provide services, either in the form of documents or as a marketplace for consultancy.

Each macro-category above, can be further subdivided in relation to specific tasks. Over the years, the LegalTech industry has grown to include, on the one hand, software and technological tools that simplify legal practice for lawyers; on the other, digital tools that simplify the acquisition and management of legal services for clients by reducing or eliminating the need to consult a lawyer (or making it easier to find the right one quickly).

Sector specific applications

With regards to the industry sector-specific applications, among the main areas of interest in the LegalTech scene we find:

– Regulatory compliance: providing support to comply with the applicable regulatory rules within the financial transactions ecosystem, e.g. compliance with regulatory reporting requirements, market agreements, asset management (investment funds, Sicafs and Sicavs);

– Fintech, Regtech and Insurtech : from open banking to cryptoactivity/cryptocurrency, firms engage in the blockchain sector through the creation and use of cryptocurrency and cryptoactivity, smart contract as well as in the open banking and PSD2 sector.

– Alternative finance – from traditional crowdfunding to Ico/Sto: Crowdfunding is an increasingly effective method of collecting finance from alternative sources. Equity and debt offerings can be an asset for companies that need financial resources. Ico and Sto are an effective way to raise capital and exploit the potential of the blockchain.

2. Big Data and Artificial Intelligence use cases

Law firms will increasingly need to provide qualified assistance to their clients on innovative issues such as artificial intelligence liability and data-based behavior modeling. Other areas where they will be engaged are e-commerce and online business, corporate and M&A, i.e. assistance in corporate and commercial law matters with a focus on the specific needs of high-tech companies.

At a higher level, LegalTech is the legal industry’s way of achieving digital transformation, i.e. using software and technology to simplify operations, become leaner and satisfy modern customers.

Existing solutions and main applications

The LegalTech industry includes the following software solutions and technologies:

  • Workflow software tools
  • Artificial intelligence / machine learning algorithms (AI / ML)
  • analysis software tools and big data
  • customer experience solutions (CX)
  • cloud technology
  • distributed accounting technology (DLT)

Areas of application:

– AI / ML document review: data-trained algorithms that analyze legal documents in many areas, from risk management to mergers and acquisitions and compliance cases;

– document and contract management platforms: tools that simplify or automate the creation of templates, negotiation of clauses and content analysis;

– Workflow tools: systems that allow lawyers to digitize and automate workflows;

– smart contracts: autonomous execution clauses in legal contracts enabled by DLT, Internet of Things (IoT) and others;

– e-discovery tools: solutions that simplify and automate e-discovery steps, such as machine learning algorithms that collect and process documents to be reviewed and finalized by a lawyer;

– legal chatbots: automatic tools based on AI / ML engines that allow users to get answers to basic legal questions in a chat or messenger;

online markets: digital platforms that help clients to find the right lawyer faster;

cloud-based databases: data is collected in a single data warehouse that employees in all departments can access;

Data security – ensuring the highest level of security for legal documents with DLT.

3. LegalTech and lawtech: what is the difference?

Finally, it is time to highlight the difference between LegalTech and lawtech. Some experts believe that the two terms have different purposes: the first refers to software and technologies that lawyers use to simplify their work (e-discovery, revision of the AI / ML document) while lawtech includes products for their clients (legal chatbots, online consultancy services markets). Other lawyers believe that lawtech is not an appropriate name for the industry, as it implies the subject matter of the law in general rather than an industry. In several publications, lawtech and legaltech are used interchangeably, although the term LegalTech seems to prevail and to be most commonly used in the worldwide legal technology scene.


This post is part of TechnoLawgy Guest Post series and has been written by the brilliant  Alessandro Rubino, Practising lawyer  & Legal of Innovation. Access the italian version of this post here.

If you are a interested in sharing your expertise with TechnoLawgy international readers hit the Contact button above.   

Get the latest #Privacy and #LegalTech news on > TechnoLawgy Telegram channel <