Extract to table

Our key conclusion is as follows: while no EU data subjects are currently in scope — all approximately 800,000 opted-in vehicles are registered in North America — hosting VMS data on EU infrastructure could trigger obligations under Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR") and introduces regulatory complexity that must be addressed in the Data Processing Agreement ("DPA")

facility; and (iii) specifying the legal mechanisms — including, at a minimum, the European Commission's Standard Contractual Clauses ("SCCs") — that must be in place before any cross-border transfer occurs

In the absence of a valid adequacy decision, transfers of personal data to the United States must rely on one of the "appropriate safeguards" enumerated in Article 46 of the GDPR

If the assessment reveals that the third country's legal framework undermines the protections provided by the SCCs, the data exporter must implement "supplementary measures" to fill the gap, or refrain from transferring the data

Any migration of VMS data to Dublin must be covered by contractual provisions satisfying these requirements

(ii) Notification to Supervisory Authority: To the extent required by applicable law (including GDPR Article 33), Meridian or Cloudvault shall notify the competent supervisory authority within the timeframe specified by such law — currently 72 hours under the GDPR — provided that VMS shall have the right to review and approve the content of any notification to a supervisory authority before it is submitted