Verizon holds fully approved Binding Corporate Rules for Processors that protect transfers of personal data from customers in the EU and the UK to Verizon Business Group and Verizon group companies in other countries. Alternatively, if necessary, Verizon is able to enter into Standard Contractual Clauses (“SCCs”).  The transfer mechanism that is applicable to the specific transfer is set out in your agreement with Verizon.

The European Commission has determined that safeguards that the United States has put in place (referred to in the adequacy decision for the Data Privacy Framework between the EU and the U.S.) will also facilitate transatlantic data flows more generally. These safeguards also apply when data is transferred using other recognized tools, such as Binding Corporate Rules and SCCs.

Verizon does not anticipate signing up for the EU/US Privacy Framework because Verizon utilizes EU and UK Binding Corporate Rules, an approved adequacy mechanism recognized by the GDPR and UK data protection law. Binding Corporate Rules protect the transfer of personal data from the EU and the UK to Verizon companies in the United States and also in countries around the world, thereby providing more comprehensive protection for Verizon’s customers and their end users. Like Binding Corporate Rules, the Data Privacy Framework is another approved mechanism under the GDPR and UK data protection law, but unlike Binding Corporate Rules, the Data Privacy Framework relates only to the transfer of personal data from the EU to the US.

Verizon’s detailedInternational and US Transparency Reports provide information about the number of requests Verizon receives.

Whether your organization’s personal data will be subject to government requests for data will depend on many factors, including the nature of the services and the type of data at issue. We note that Verizon receives relatively few demands regarding our enterprise customers.

Verizon does not release personal data unless authorized by law, such as a valid law enforcement demand. Verizon has teams that carefully review each demand we receive. We do not produce information in response to all demands we receive.

FISA

In the U.S., Verizon is generally subject to the provisions of the Foreign Intelligence Surveillance Act (FISA), including the provisions contained in 50 U.S.C. § 1881a (commonly known as “Section 702”). Depending on the services being provided, Verizon may be considered an “electronic communication service provider” as specified in 50 U.S.C. 1881(b)(4) and therefore covered by the law. Compelled electronic surveillance under FISA is overseen by the Foreign Intelligence Surveillance Court.

EO 12333

This is an Executive Order relating to the conduct of U.S. intelligence agencies. Outside of FISA, Executive Order 12333 does not provide the U.S. government with any additional authority to compel the production of data from U.S. companies.

Other relevant laws 

Other US laws, at both the federal and state level, authorize law enforcement to compel Verizon to produce data through various types of legal process. A general description of the types of legal process and the types of data they can be used to compel Verizon to produce are described in Verizon’s Transparency Reports.

As noted in Verizon’s Transparency Reports, Verizon receives relatively few demands relating to our enterprise customers. If Verizon were to receive a Section 702 request specifically seeking the personal data of an enterprise customer, that request would receive thorough scrutiny in our review process.

Verizon provides cloud computing and data storage services to business customers around the world (including many non-U.S. customers), supported by  data centers outside the United States. As we have noted in our Transparency Reports, we have not received any demands from the United States government for data stored in other countries for the periods covered in those reports.

Due to the restrictions in the FISA, orders of the Foreign Intelligence Surveillance Court, and/or requirements for the handling of classified information, if Verizon were to receive a directive under Section 702 or to otherwise be involved in national security surveillance activities, it would not be able to describe such activities.

While Verizon does not disclose the specifics of individual requests, Verizon does report on its responses to both law enforcement and national security requests in its biannual Transparency Reports. For national security requests, our Transparency Reports include all the information we are permitted to disclose.

Verizon’s Binding Corporate Rules set forth additional safeguards employed by Verizon in connection with legally binding requests from law enforcement agencies or state security bodies for disclosure of personal data of customers transferred to Verizon entities outside the EU/UK. These additional safeguards include, unless prohibited from doing so by the requesting authority, putting the request on hold, and notifying the customer and the supervisory authority competent for each of the customer and the processor. If prohibited from doing so, Verizon will use best efforts to obtain a waiver of this prohibition in order to communicate as much information as it can and as soon as possible to the competent supervisory authorities, and demonstrate to the competent supervisory authorities the steps it followed to deal with the request in accordance with the BCRs. Verizon will provide to the competent supervisory authorities on an annual basis general information about the nature and number of such requests that it receives, type of data requested and the requesting body if possible. In any event, Verizon will ensure that any transfers of customer personal data under the BCRs that it makes to a public authority are not disproportionate or indiscriminate in a manner that would go beyond what is necessary in a democratic society.