International Data Transfer

What it is

Your personal data may be stored and processed in the United States or other countries that may have different or less protective privacy laws than your home country. Using the service is treated as acknowledgment of this transfer.

Why it matters (compliance & governance perspective)

For EU and UK users, international data transfers to the United States require a lawful transfer mechanism under GDPR Chapter V, such as Standard Contractual Clauses. The policy's reliance on user acknowledgment through service use as a consent mechanism for transfers may not satisfy GDPR transfer requirements.

Consumer impact (what this means for users)

EU and UK users' personal data is transferred to and processed in the United States. Under GDPR, this transfer must be supported by an appropriate legal mechanism such as Standard Contractual Clauses; the policy does not describe which transfer mechanism Runway relies upon.

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V (Articles 44-49) on international data transfers, and UK GDPR equivalent provisions. Following the Schrems II decision by the Court of Justice of the EU, transfers to the United States require either reliance on the EU-US Data Privacy Framework (if Runway is certified), Standard Contractual Clauses with supplementary measures, Binding Corporate Rules, or another Article 46 mechanism. The policy does not specify which mechanism Runway relies upon. 2) GOVERNANCE EXPOSURE: Medium. The policy states that users acknowledge international transfers by using the service, but acknowledgment through continued use does not constitute a valid GDPR Article 49 derogation for systematic transfers. The absence of a disclosed transfer mechanism in the policy text creates a compliance documentation gap that supervisory authorities may scrutinize. 3) JURISDICTION FLAGS: EU member state supervisory authorities and the UK Information Commissioner's Office have enforcement jurisdiction over unlawful international transfers. Transfers involving special category data (which may include biometric data under GDPR Article 9) are subject to heightened transfer requirements. Switzerland-based users are subject to the revised Federal Act on Data Protection, which also has international transfer requirements. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers with EU or UK users should request documentation of Runway's international transfer mechanisms, particularly Standard Contractual Clauses or EU-US DPF certification. Data processing agreements should include transfer mechanism provisions and supplementary measures documentation. 5) COMPLIANCE CONSIDERATIONS: Runway's legal team should ensure the privacy policy is updated to disclose the specific transfer mechanisms relied upon for EEA and UK user data transfers. Data protection impact assessments may be required for transfers involving biometric or other sensitive personal data. Enterprise customers should conduct transfer impact assessments where required under their own GDPR obligations.

Applicable regulations

Provision details

Other risks in this policy

• Biometric Data Collection high
• Advertising Partner Disclosure as Potential CCPA Sale high
• User Content Collection Including Prompts and Generated Outputs medium
• Enterprise Account Administrator Access medium
• Business Transferee Data Disclosure medium
• GDPR Legitimate Interests Legal Basis medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.