No blanket exclusion of US cloud providers
The Karlsruhe Higher Regional Court has decided that subsidiaries of US corporations may not be excluded from procurement procedures across the board. A much-criticized decision by the Baden-Württemberg Public Procurement Chamber of July 13, 2022 was thus overturned.
A decision by the Public Procurement Chamber of Baden-Württemberg (VK BW) of July 13, 2022, Az. 1 VK 23/22, caused a lot of excitement. At that time, it was decided in a procurement procedure that EU-based subsidiaries of US corporations were not allowed to participate in public procurement when it came to the processing of personal data. According to the judgment, this is accompanied by an inadmissible data transfer to the USA, which violates the General Data Protection Regulation (GDPR).
No blanket exclusion of US subsidiaries
The controversial decision of the VK BW has now been overturned by the Karlsruhe Higher Regional Court (Az. 15 Verg 8/22). However, the Karlsruhe Higher Regional Court has not issued carte blanche to awards to subsidiaries of companies not based in the EU: As is so often the case, it depends on the circumstances of the individual case.
“Only when there are concrete indications that there are doubts about this, does the contracting authority have to obtain additional information and check whether the promise of performance can be fulfilled,” says the press release from the Higher Regional Court of Karlsruhe. Furthermore, according to the judgment, contracting authorities “do not have to expect that the Luxembourg company will follow instructions that are contrary to contract and European law and will transfer personal data to the USA.” The fact that it is a (in this case Luxembourg) subsidiary of a US group being is therefore by no means sufficient for an exclusion from the award of a contract.
Uncertainty persists
If the Karlsruhe Higher Regional Court had confirmed the decision of VK BW, there would have been a risk of providers of US corporations being excluded from numerous procurement procedures. Instead, the judgment now focuses on a continuing uncertainty: the processing of personal data that is questionable under data protection law if there is a connection to a non-EU country or a country without an “adequate data protection level” recognized by the EU Commission. Especially in relation to the USA, with which the EU has been struggling for a successor agreement for the “EU-US Privacy Shield” since July 2022. A corresponding agreement is currently in the works, but it is questionable whether things will really calm down after it comes into force.
Source: OLG Karlsruhe
