DTIA AWS

Data Transfer Impact Assessment (DTIA) on the transfer of Content Data to the USA processed in Amazon EC2, Amazon $3, and Amazon RDS a) Data exporter (or the sender in case of a relevant onward transfer): b) Country of data exporter: c) Data importer (or the re tin case of a relevant onward transfer): d) Country of data importer: e) Context and purpose of the transfer: f) Categories of data subjects concerned: ge) Categories of personal data transferred: h) Sensitive and special categories of personal data: i) Technical implementation of the transfer: fl) Technical and organizational measures in place: k) Relevant onward transfer(s) of personal data (if any): Countries of recipients of relevant onward transfer(s): Dutch government organisation [X] Netherlands Amazon Web Services, Inc. ("AWS, Inc.", abbreviated in this DTIA to: "AWS" USA. Seller of Record is Amazon Web Services EMEA SARL ("AWS Europe"), a Luxembourg-based AWS entity.

Both AWS and AWS Europe are wholly owned subsidiaries of Amazon.com, Inc. AWS works with Regions, a physical location in a country where data centers are clustered. AWS has Regions in the EU. Each AWS Region consists of a minimum of three, isolated, and physically separate AZs within a geographic area. AWS calls each group of logical data centers an Availability Zone. Employees of the MO! or any other Governmental entity that use Amazon EC2, Amazon $3, and Amazon RDS to store and process Content Data. Employees of the Dutch government , possibly external data subjects whose data are processed by MOJ or any other governmental organisation as Content Data. Any kind of Content Data actively provided by the customer to the 3 tested AWS services Data stored in the 3 AWS services may include classified information, personal data of a sensitive nature (for example location data, salary information, company or personal confidential information), data relating to children under 16 years and special categories of data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, Art. 9 GDPR).

Content Data may also include personal data relating to criminal convictions and offences or related security measures (Art. 10 GDPR). Customers of the 3 AWS services can decide for within which availabil one they want to store their data. AWS does not operate a data centre in the Netherlands. Privacy Company chose to set-up the $3 buckets in the eu-central-1 region, an AWS Region based in Europe (Frankfurt). AWS does not have a Region in the Netherlands, but customers may choose to use AWS services deployed at an AWS Edge Location (available in The Netherlands), an AWS Local Zone (announced for Amsterdam, The Netherlands), or AWS Hybrid Solutions from customer or partner premises. Reference: ps://aws.amazon. fi /global-infrastructure/regions_az/an AWS data centre in Frankfurt AWS provides HTTPS endpoints using the TLS protocol for communication, which provides encryption in transit when customers use AWS APIs.

Customers should use TLS 1.2 or later. Customers can use the AWS Certificate Manager (ACM) service to generate, manage, and deploy the private and public certificates they use to establish encrypted transport between systems for their workloads. AWS KMS and ACM support the hybrid post-quantum TLS ciphers. AWS Certificate Manager supports the importing of third party certificates. AWS provides the customer with many security, identity, compliance services for consideration as supplementary technical and organizational measures. References: https://docs.aws.amazon ei [ html https://aws.amazon.com/blogs/security/tls-1-2-required-for-aws-endpoints/ https://aws.amazon. /security/post-quantum-cryptography/ Elastic Load Balancing is integrated with ACM and is used to support HTTPS protocols. If Content Data are distributed through Amazon CloudFront, it supports encrypted endpoints. In the contract with the Dutch government, AW'S guarantees that it has not created any “!

"or similar pr ing in the Services that could be used by AWS or by third parties to obtain unauthorised access to the system and/or personal data stored in the system. Customers can encrypt Content Data in block storage and 53. Depending on the risks of unauthorised access to the data, government organisations may want to use AWS Nitro, acallection of security measures that allows hardware based VM encryption and key management for customer virtual machines. See: https://aws.amazon.com/ec2/nitro/ ‘SLM Rijk and AWS have signed the new Controller to Processor SCC. AWS does not engage third party subprocessors to process Content Data from the 3 tested services, only uses infrastructure and services run by its own subsidiairies. The AWS Sub-Pracessors page lists the AWS services for which third-party service providers may be used, if a customer decides to use these extra serwices, such as for example messaging services.

URL: tps://aws.amazon.com/ liance/sub es: Asmall number of AWS services involve the transfer of Content Data, far example, to develop and improve those services. Customers can and are advised to opt-out of these transfers. Transfer may also be an essential part of the service (such as a content delivery service). Customers can identify these services on the ‘Privacy Features of AWS Services’ web page, at URL: https://aws.amazon.com/compliance/privacy-features/. The possible access to Content Data in third countries, as part of support tickets, is covered in the separate tab ‘Support Data’. AWS recommends that customers never put ial i tion or directly personal data such as their email addresses into tags or free-form text fields such as a Name field. This includes when they work with AWS Support or other AWS services using the consale, API, AWS CLI, or AWS SDKs. Rationale a) Starting date of the transfer: [Gov org to fillin the date] b) Assessment period in years: 2 ¢) Ending date of the assessment based on the above: M42 d) Target jurisdiction for which the DTIA is made: USA e) Is importer an Electronic Communications Service Provider as defined in USC Yes § 1881(b)(4): f) Does importer/processor commit to legally resist every request for access: Yes g) Relevant local laws taken into consideration: FISA Section 702, other FISA warrants such as business: This DTIA takes the risks of types of islation i traditional I ond court records, pen registers and trap and trace devices, National warrants, os well as secret servis isotions.

Since AWS Security Letters (secret services) and US Cloud Act, US Stored offers ‘remote computing services’ that are part of the definition of ‘Electronic Communications Service Provider’ Communications Act (SCA),NSLs based on ECPA, as defined in article 50 of the US Code par. 1881(b) under 4, sub c, the US government has the authority to ee agaERCEH Additionally, tho ts Seas Conninscboons areas is coumae aight Tomas iatosdes oo raid warrants, Additionally, mass surveillance / cable interception cain thins thrieigh MLAT requests 3 based on EOP 12333 (mitigated by PPD-28). hemes = x seatinine'seenetaes mosuiie: ti sedioes leap foose shat: custamers. a) Number of cases under the laws listed in Step 2g per year in which an authority in the USA is estimated to attempt to obtain relevant data through legal action during the period under consideration. b) Share of such cases in which the request occurs in connection with a case ‘that due to its nature in principle permits the authority to obtain the data also from a provider 179410141 Probability Cases Cases Rationale per case per year remaining 0,50 The number of 0,5 case per year is it AWS's own sporting that none of the subpoenas, search warrants and| in the dis LS.

Enterprise Content Data ited States. Si the metric in the reports (July 2020), the reparts nates: in US. i content dota located outside the United States? None." AWS does not provide specific information if EU customer Content Dato were disclased to security services. AWS. only mentions o range between and 249. For clarity, under US low, providers con neither confirm nor deny iaivetei ae The estimate is also based on the histarical lable in this sector, and based ona number greater than zero. 100% 0,50 ir Addendum, AWS requests ar gagging AWS that it hallenged demands for customer inning decisions that have helped te set the legal standards for addendum-to-the-ows-dpa.pdf. Additionally, in Clause 14 of the SCC AWS quarantees it has no reasan to believe that it cannot fulfill its 0016 0674 ¢ d) Probability that in the remaining such cases it will be possible for the 90% 0,05 company to successfully cause the authority (by legal means or otherwise) to give up its request for the data in plain text Probability that in the remaining cases the requested data will be provided 25% 0,04 in one way or another (e.g., with consent or through legal or administrative assistance) Probability that in the remaining cases the authority will consider the data it 10% 0,00 is seeking to be so important that it will look for another way to obtain it Number of cases per year in which the question of lawful access by a foreign authority arises Number of cases in the period under consideration 0,00 itis ‘However, A the KMS AWS odds: 140- Zor complionce with FiPS 140-2. of FIPS 140-2.

External An of {HSM}, This F 31 through ta 33. unlikely, Europeen Commission for the USA. Since AWS |3 @ processor, and not a for tela in abtining a FSA 702 order. This detay with SEC hes 702 order. Prerequisite for success Probability per case a) ¢) a) e) a) Probability that the authority is aware of the provider and its subcontractors 100% (prerequisite no. 1) Probability that an employee of the provider or its subcontractors will gain 100% 0,00% access to the data in plain text in a support-case ... (orerequiwte no. 2) ~. and is able to search for, find and copy the data requested by the 0% authority (prerequisite na. 3) Probability that despite the technical countermeasures taken, employees of 10% 1,00% the provider, of its subcontractors or of the parent company technically have access to data in plain text (also) outside a support situation (e.g., using admin privileges) or are able to gain such access, e.g., by covertly installing a backdoor or "hacking" into the system (irrespective of whether they are allowed to do so) ...

(prerequisite no. 2) .. and are then able to search for, find and copy the data requested bythe 10% authority (prerequisite na. 3) Probability that the provider, the subcontractor or its parent company, 50% respectively, is located within the jurisdiction of the authority (nrerequiete no. 4) Probability that despite the technically limited access and the technical and 1% organizational countermeasures in place, the authority is permitted to order the provider, its subcontractor or the parent company, respectively, to obtain access to the data and produce it to the authority in plain text (prerequisite no. 5) Probability that if data were to be handed over to the foreign authority, this 50% would lead to the criminal liability of employees of the provider or its subcontractors, the prosecution of which would be possible and realistic, and as a consequence, the data does not have to be produced or is not Produced (sreequisite no. 5} ity that th does not succeed in removing 50% the relevant data in time or it from the provider's ‘@CDESS [prerequisite no. T} Residual risk of successful lawful access by a foreign authority through the provider (given the countermeasures): 1% .

See: This occess, eliminating the possibility of humon error ond tampering. Nitra provides customers with of fegrity of the . This stored Hawever, only the US Legal Basis considered for the following assessment: Section 702 eign Act (FISA), CIA based Order (EO) 12333 Probability in the period Rationale a) Probability that the data at issue is transmitted ta the provider or its 0% 0,00% 0,00% 715 1.2 or later. subcontractors ina manner that permits the telecammunications providers ciphers. in the country to view it in plain text as part of an upstream monitoring of Internet backbones b) Probability that the data transmitted will Include content picked by selectors 0% 71S 1.2 or jater. TS (Le, intelligence search terms such as specific recipients or senders of a electronic communications) c) Probability that the prowider or a subcontractor in the country is technically 0% 0,00% TLS 1.2 ar later.

AWS KMS ms able to on an ongoing basis search the data in plain text for selectors (i.e. eee: search terms such certain recipients or senders of electronic communications) without the customer's permission as part of a itoring of online d) Probability that the provider or a subcontractor in the country above may be 1% This for Romaiad; legally required to perform such as search (also) with the company's data pi e) Probability that the data is regarded as content that is the subject of 10% intelligence searches in the country as per the above laws. sensces. However, of rrption, tekst és very low. of bya foreign ithout any of legal {in view of the 0,00% Probability that the question of lawful access via the cloud provider will arise at all (1 case in the period = 100%) 179410141 0016 0,75% 0675 Probability of successful lawful access by the foreign authorities concerned in these cases despite the countermeasures 0,00% Probability of additional successful lawful access by a foreign intelligence service where there is no guarantee of legal recourse (despite 0,00% Overall probability of a successful lawful access to data in plain text via the cloud provider in the observation period: Description in words (based on Hillson*): Very low The number of years it takes for a lawful access to occur at least ance with a 90 percent probability: co The number of years it takes for a lawful access to occur at least ance with a $0 percent probability: = assuming that the prabability neither time (like * Scale: <5% = “Very low", S-10% = "Low", 11.25 = "Medium", 26-50% = "High" ond >50% = “Very high" (by David hilison, 2005, see hetps://www.pmi. inal ibing-probability-timitat tural-language-7556) a) Estimated probabil f lawful vise 9.00% b) Estimated impact of risk Very High High Wouid it be feasible, from a practical, technical and economical point of a) —_view, for the data exporter to transfer the personal data in questiontoa Yes location in a whitelisted country instead? b) Is the personal data fi under one of the Pursuant to applicable data protection law (e.g., Art. 49 GDPR in case of the GDPR)? g ® the personal data at issue transmitted to the target jurisdiction in clear text (i.e. there is no appropriate encryption in-transit)?

Is the personal data at issue accessible in the target jurisdiction in clear text d) by the data importer/recipient or a third party (i.e. the data is either not Yes appropriately encrypted or access to the keys to decrypt is possible)? Is the personal data at issue protected by a transfer mechanism approved by the applicable data protection law (e.g., the EU Standard Contractual Clauses in case of the GOPR, approved BCR, or - in the case of an onward transfer - a back-to-back-contract in line with the EU SCC), and can you expect compliance with it, insofar permitted by the target jurisdiction, and judicial enforcement (where applicable)? e) Very Low 32 regular personal data in the clear High Describe why you stil do not pursue this option Ensure thot data Based on the answers given above, the transfer is: permitted Final Step: Conclusion In view of the above and the applicable data protection laws, the transfer is: This Transfer Impact Assessment has been made by: SLM Rijk / PRIVACY COMPANY 179410141 verte Place, Date: Signed: Rationale The Content Data can, pe f dota. are advised to apply their own encryption to such sensitive ond special categories of dato uniess the dota are already public (such as court hearings).

The risk is bona in ) if the Ei decision for the USA (2) if or if they do, decision (3) they fond they employer identity should remoin confidential) Wes, EU government customers can choose an EU awaliatality sone for the Content Dato at rest No Strang recammendation to admins to apply encryption with their own key fo sensitive and special categones of dota 2, Amazon $3, and ADS. Dato in tronsit are encrypted by AWS (SSL/TLS). if the government organisation does aot apply encryption with a seif-controlied key, but applies AWS's disk encryption, theoretically it is possible that AWS is ardered to copy the decrypted data white they are being used, AWS Nitro System is desig access to even AWS. the content on VMs, even while in use. With regord to Amazon 53 the customer con implement its own encryption on the data stored in 53, with seif- managed keys. Not al! applications allow for that type af encryption, if the data have to be shored with parties that connot be trusted with the encryption keys SUM Rijk and AWS have signed the new SCC Contraller to Processor.

Absent o new adequacy decision from the EU for the USA, admins should apply encryption to Content Data with a seif-controlled key if they want fo use AWS to store sensitive and special categories af data. Reassess at the latest by: X+2 (or if there are any changes in circumstances) By: [Government org x) 0016 0676 Data Transfer Impact Assessment (DTIA) on the transfer to the USA of Diagnostic Data resulting from the use of EC2, A $3, and RDS This DTIA SLM Rl, us ‘the template provided by David Rosenthal, provided under CC license a) c) Data exporter (or the sender in case of a relevant onward transfer): Country of data exporter: Data importer (or the recipient in case of a relevant onward transfer): Country of data importer: Context and purpose of the transfer: Categories of data subjects concerned: Categories of personal data transferred: Sensitive and special categories of personal data: Technical implementation of the transfer: Technical and organizational measures in place: Relevant onward transfer(s) of personal data {if any): Countries of recipients of relevant onward transfer(s): Dutch government organisation [X] Netherlands Amazon Web Service: USA.

Seller of Record is Amazon Web Services EMEA SARL ("AWS Europe"), a Luxembourg-based AWS entity. Both AWS and AW’ Europe are wholly owned subsidiaries of Amazon.com, inc. AWS works with Regions, a physical location in a country where data centers are clustered. AWS has Regions in the EU. Each AWS Region consists of a minimum of three, isolated, and physically separate AZs within a geographic area. AWS calls each group of logical data centers an Availability Zone. Diagnostic Data are generated in the AWS Region where the service is used, and depending on the scope of the customer's interactions with AWS Offerings, may be stored in or accessed fram multiple countries, including the United States. References: https://aws.amazon infrastructure/regions_az/ Diagnostic Data about the individual actions of employees of he MO} or any other Governmental entity that use Amazon EC2, Amazon $3, and Amazon RDS to store and process Content Data Employees of the Dutch government.

Diagnostic Data generated through the use by admins of Amazon EC2, Amazon 53, and Amazon ROS in service generated server logs and in security logs. The security logs are described in the separate tab ‘Security Data, T&S' because of the role of AWS as data controller, in stead of processor. Diagnostic Data may reveal a work pattern of admins. However, based on the outcomes of the recent C5:20202 audit, in particular the results of the audit on the OPS-11 basic criterion, AWS was found to only collect and use the Diagnostic Data for the 3 purposes of billing, incident management and security incident management purposes . The audit report also states: “Exclusively anonymaus metadata to deploy and enhance the cloud service so that no conclusions con be drawn about the cloud customer or user." Diagnostic Data may include Account Data fram employee administrators whose identity should remain confidential.

This TIA assumes i will pseudonymise admin account data by using identity federation. See row 13 below. Diagnostic Data are generated at the location where the service is used, and may be transferred to the USA for further processing by AWS as controller for the agreed legitimate business purposes. Depending on the scope of the customer's interactions with AWS offerings, Diagnostic Data may be stored in or accessed fram multiple countries, including the United States. AWS has elaborate Security Standards, and has its compliance with these standards tested in different types of audits. The reports are available for customers. Admins can and should pseudonymise their Account Data (collected in the Diagnostic Data). AWS offers solutions to federate customer's employees, contractors, and partners (workforce) to AWS accounts and business applications, and affers federation support to customer's end-user-facing web and mobile applications.

AWS supports commonly used open identity standards, including Security Assertion Markup Language 2.0 (SAML 2.0), Open ID Connect (OIDC), and OAuth 2.0. URL: https://aws.amazon.com/id As additional mitigating measures AWS strongly recommends that customers never put i ‘ion or divestipi ifiable personal data, such as their email addresses, into tags or free-form text fields such as a Name field. Additionally, AWS commits to use every reasonable effort to redirect valid and binding orders for Diagnostic Data to its Customer. If compelled to disclose Personal Data to a Requesting Party, AWS will (I) promptly notify Customer of the Request ta allow Customer to seek a protective order or other appropriate remedy, if AWS is legally permitted to do so. If AWS is prohibited from notifying Customer about the Request, AWS will use all reasonable and lawful efforts to abtain a waiver of prohibition, to allow AWS to communicate as much information to Customer as soon as possible; and (ii) challenge any overbroad or inappropriate Request (including where such Request conflicts with the law of the European Union or applicable Member State law) AWS does not engage third party subprocessors to process Content Data fram the 3 tested services, only uses infrastructure and services run by its own subsidiairies.

The AWS Sub-Processors page lists the AWS services for which third-party service providers may be used, if a customer decides ta use these extra services, such as far example messaging services. URL: https://aws.amazon.com, b / AWS applies encryption to all data in transit. SLM Rijk and AWS have signed the new Controller to Processor SCC. In thi with the Dutch AWS that it has not purposefully created any "backdoors" or similar programming in the Services that could be used by AWS or by third parties to obtain unauthorised access to the systems and/or Diagnostic Data stored in the system. nfa Starting date of the transfer: Assessment period in years: Ending date of the assessment based on the above: Target jurisdiction for which the DTIA is made: 1s importer an Electronic Communications Service Provider as defined in USC § 1881(b)(4): Does importer/processor commit to legally resist every request for access : Relevant local laws taken into consideration: Rationale [Gov org to fill in the date] 2 M42 USA Yes Yes FISA Section 702, other FISA warrants such as business records, pen This DTIA takes of types of | sf and court fepisters and trap and trace dewices, National Security Letters (secret pvicui amit crenes ren iprinestnne Serre Ee detters and FISC authorisations.

Since AWS services) and US Cloud Act, US Stored Communications Act (SCA),NSLs offers ‘thar are part of lectronic Ci ( based on ECPA, and judicially sid oars ‘as defined in articte 50 of the US Code par. sib eS gre warrants. J cable based on engage i on EOP ehesinaoaliegs EOP 12333 (mitigated by PPD.28), Additionally, the US Stored Communications Act and US LOUD Ret aay This DTIA does “not™ assess the risks of req if MLAT requests. AWS n heeisaaiiies iz 1pan to from their customers. Probability Cases Cases Rationale per case per year remaining a) Number of cases under the laws listed in Step 2g per year in which an 0,50 The number of 0,5 case per year i AWS" reparting ice that authority is estimated to attempt to obtain relevant data through legal_ pone " a srradand - aeoaania pole rd 5 ps ae 5 ‘ fi es interprise Content Data located outside the United States. Since AWS included the metric in the reports action during the period under consideration. sc the " US. government of fpr ‘government located outside the United States?

None.” AWS does not provide specific ir ion if it has ever disclosed Diagnostic security services. See: formation-reqi The i it inthe. available in this sector, and on the requirement to calculate based on a number greater than zero. b) Share of such cases in which the request occurs in connection with a case 100% 0,50 in the AWS. Addendum, or that due to its nature in principle permits the authority to obtain the data apes dr pecigrelh eatin AWS walle SAGE Mes speeds ponrectoenanted it sett Iso ft ad also from a provider ied oddendum-to-the-aws-dpe.paf. Additionally, perenne glia to believe that it cannot fulfill its orders and requests. ca) Probability that in the remaining such cases it will be possible for the 10% O45 The Diagnostic Dota ane ovate or A eenerens in the cfear, customers cannot encrypt these daca with self- . arder to company to successfully cause the authority (by legal means or otherwise) Date in spite ‘its commitment: to give up its request for the data in plain text ee ee eee 4 ) ity that in the remaining cases the data will be provided 25% 0,34 There is AWSis Diagnostic Dato, in spite of Consent fram in one way or another (e.g., with consent or through legal or administrative om EU Enterprise Costormer: fe unlltely, fo date if rape istance) Commission for the USA.

Since AWS and f in the Content assstenioe: Data, ime for the US iti ic Additionally, there wit! be a delay in abtaining an FISA 702 arder. This delay enables AWS to inform the custamer that it carne Janger comply with SCC quavantees without disclasing that it has received a FISA 702 order. ) Probability that in the remaining cases the authority will consider the data it 10% 0,03 0,03 i this question ti i is hacked or is seeking to be so important that it will look for another way to obtain it veal siammakaicncened Number of cases per year in which the question of lawful access by a foreign authority arises 0.03 Number of cases in the period under consideration 0,07 179410141 0016 0677 Legal Basis considered for the following assessment: ‘Section 702 FISA, other FISA warrants such as business records, pen registers and (secret ‘US Cloud Act, US Stored Act (SCA, ECPA, and judicialty and search warrants, Prerequisite for success Probability per case Rationale a) Probability that the authority is aware of the provider and its 100% 100% of SUBCONTTACtOrS |prerequisite na. 4) ) Probability that an employee of the provider or its subcontractors will gain 100% 100,00% 100% access to the data in plain text in a support-case ...

(prerequisite no 2) «. and is able to search for, find and copy the data requested by the 100% authority iorerequisite no, 3) ¢] Probability that despite the technical countermeasures taken, employees of 100% 190,00% ‘the provider, of its subcontractors or of the parent company technically have access to data in plain text (also) outside a support situation (e.g., using admin privileges) or are able to gain such access, e.g., by covertly “bockdoors* installing a backdoor or “hacking” into the system (irrespective of whether ‘they are allowed to do 50) ... iprerequisne no. 2) out, «and are then able to search for, find and copy the data requested by the 100% dew authority iprerequinze no. 3) d) Probability that the provider, the subcontractor or its parent company, 100% 100% the al is located within the af the authority (prerequnite no a) tronvered tothe 5. e) Probability that despite the technically limited access and the technical and 100% 100% ‘organizational countermeasures in place, the authority is permitted to order There cre: the provider, its subcontractor or the parent company, respectively, to obtain access to the data and produce it to the authority in plain text (orerequiate 0.5] Probability that if data were to be handed over to the foreign authority, this 30% 20% as would lead to the criminal liability of employees of the provider or its eseenats or a 2020 ouniit, there subcontractors, the prosecution of which would be possible and realistic, pa and as a consequence, the data does not have to be produced or is not produced iorereautsite ma. 6) 2 e Probability that the company does not succeed in removing the relevant 100% 100% data in time or otherwise withdrawing it from the provider's access be (prenequivte no. 7] Residual risk of successful lawful access by a foreign authority through the pravider (given the countermeasures): 20,00% Legal Basis considered for the following assessment: Section 702 US Foreign Intelligence Surveillance Act (FISA), CIA (£0) 12333 Probability in the period Rationale a) Probability that the data at issue is transmitted to the provider ar its 0% 0,00% 0,00% AWS applies encryption to all date in transit. subcontractors in a manner that permits the telecommunications providers in the country to view it in plain text as part of an upstream monitoring of Internet backbones b) Probability that the data transmitted will include content picked by 0% AWS applies encryption to all data in transit. selectors (i.e, intelligence search terms such as specific recipients or senders of electronic communications) c) Probability that the provider or a in the country is i 0% 0,00% AWS apyplies encryption to all date in transit. able to on an ongoing basis search the data in plain text for selectors (i.e. search terms such certain recipients or senders of electronic communications) without the customer's permission as part of a of online d} —- Probability that the provider or a subcontractor in the country above may 50% be legally required to perform such as search (also) with the company's data use identity federation (see above in 113), e) Probability that the data is regarded as content that is the subject of 50% idem intelligence searches in the country as per the above laws Residual risk of successful lawful access by a foreign intelligence service without any guarantee of legal recourse (in view of the countermeasures): 0,00% Probability that the question of lawful access via the cloud provider will arise at all (1 case in the period = 100%) 675% Probability of successful lawful access by the foreign authorities concerned in these cases despite the countermeasures 20,00% Probability of additional successful lawful access by a foreign ii i ice where there is no of legal recourse (despite 0,00% countermeasures) Overall probability of a successful lawful access to data in plain text via the cloud provider in the observation period: iasx | Description in words (based on Hillson*): Very low The number of years it takes for a lawful access to occur at least once with a 90 percent probability: oo The number of years it takes for a lawful access to occur at least ance with a 50 percent probability: oo iat thot the probability neither time (like * Scale: <5% = "Very low’, 5-10% » "Low", 11-25 « “Medium”, 26-50% = “High” and >50% © "Very high” (by Dovid Hillson, 2005, pmi. ing-prodability-limitaric danguage-7556).

Rationale aj Estimated if 135% Very Low b) Estimated impact of risk 1s pseudanymised diagnostic data Low Very High ‘High Medium Low Very Low 179410141 0016 0678 b) qd) e) Based on the answers given above, the transfer is: | ‘Would it be feasible, from a practical, technical and economical point of Yes ‘view, for the data exporter to transfer the personal data in question to a location in a whitelisted country instead? Is the personal data under one of the ions pursuant to = No applicable data protection law (e.g., Art. 49 GDPR in case of the GDPR)? Is the personal data at i: i ‘to the target juri: in clear No text (i.e. there is no appropriate encryption in-transit)? Is the personal data at issue accessible in the target jurisdiction in clear text Yes by the data importer/recipient or a third party (i.e. the data is either not appropriately encrypted or access to the keys to decrypt is possible)?

Is the personal data at issue protected by a transfer mechanism approved Yes by the applicable data protection law (e.g., the EU Standard Contractual Clauses in case of the GDPR, approved BCR, or - in the case of an onward transfer - a back-to-back-contract in line with the EU SCC), and can you expect compliance with it, insofar permitted by the target jurisdiction, and judicial enforcement (where applicable)? Final Step: Conclusion In view of the abave and the applicable data protection laws, the transfer is: ‘This Transfer Impact Assessment has been made by: SLAM Rijk / PRIVACY COMPANY 179410141 0016 Rationale Diognastic used, and may be transferred to the USA for further rg by AWS. for the the scope of the customer's interactions with AWS offerings, Oiognastic Date may be stored ia ar accessed fram maditiple countries, inckucting the United States. Wo. Dara in transit ore encrypted by AWS (SSL/TLS) Admins tun: and should pseudonymise their Account Data with identity federotion, Yes.

The logs: ¥ sige SECC identity federation to he for configéentiol Reassess at the latest by: X+2 (or if there are amy changes in circumstances) Place, Date: Signed: By: [Government org x] 0679 Data Transfer Impact Assessment (DTIA) on the transfer of Support Data to the USA relating to Amazon EC2, Amazon $3, and Amazon RDS i ey ee aie ale seed a) Data exporter (or the sender in case of a relevant onward transfer): ‘Dutch government organisation [x] b) Country of data exporter: ‘Netherlands ¢) Data importer (or the recipient in case of a relevant onward transfer): Amazon Web Services, Inc. ("AWS, Inc.", abbreviated in this DTIA to: "AWS") USA. Seller of Record is Amazon Web Services EMEA SARL ("AWS Europe"), a Luxembaurg-based AWS entity. Both AWS and AWS Europe are whally owned subsidiaries of Amazon.com, Inc. Pep heen oe em en cmc re Dalen lage al agit fa mini of d) Country of data importer: three, isolated, and physi each group of logit centers an Zone.

Support tickets may include both Content Data and saath actions of of the MOI or any other Governmental entity that use Amazon EC2, Amazon $3, and Amazon RDS to store and process Content Data. AWS adds: create a they own the that they include in their support case. AWS doesn't access customer AWS account data without their permission. AWS doesn't share customer information with third parties. As a general risk mitigating measure, AWS strongly recommends that customers never put tial i ion or directly i personal data such as their email addresses... -ssuch tie thelr-small adresse intr’ tage or free-Horrn test fields auch as a Nirme Held. Thds lnchediag ushiet custemners work with AWS Suppett on other AWS services using the console, API, AWS CLI, or AWS SDKs. if customers provide a URL to an external server, AWS strongly not include in the URL to validate the request to that server. ‘References: https://docs.aws, I Natect/ e) Context and purpose of the transfer: Employees of the Dutch government , possibly external data subj whose d. by MOJ or any other as Content Data, A) Categories of data subjects concerned: visitors of websites hosted on AWS (their IP addresses may be logged in AWS's security and infrastructure lags) 8) Categories of personal data transferred: Account Data, Diagnostic Data and possibly snippets of Content Data.

See the separate tabs in this DTIA for Account, Diagnostic and Content Data hy Sensitive and special categories of personal data: Support Data may include sensitive Account Data, if an employee admin works for a government organisation with a high level of sensitivity. However, government organisations are strongly advised to create pseudanymous admin accounts. Support Data can include Diagnostic Data, again with pseudonymous data if pseudonyms. are used for the admin accounts i) Technical implementation of the transfer: When customers create a support case, AWS doesn't gain access ta the customers account. If necessary, support agents use a screen-sharing tool to view a customer's screen remotely and identify and troubleshoot problems. This tool is view-only. Support agents cannot export any data from the customer, and cannot act for customers during the screen-share session. Customers must give consent to share a screen with a support agent.

Eu can ask their AWS iger to flag all of their with alert. Such an alert is specific to a customer. AWS Support Engineering and Customer Service will see these alerts displayed when accessing a customer case. Such fal only wants problems solved by EU-based employees, or for example only employees in a country with an adequate data egime, such as Japan. If srpanisationsuce Chat eption, Stapport Dats wit ri longer ba jetsucturaly) crenslerradl au of the’ Eli/ea third coumies Additionally, in the contract with the Dutch government, AWS it has not s” or similar the Services used by AWS or by third pai Personal Data stored in the system. References: https://docs.aws for-suppor Atel https://docs. fuserfs y html i Technical and organizational measures in place: k) Relevant onward transfer(s) of personal data (if any): engage $ for Support, indicate they only want their tickets accessed by EU-based support employees, or support employees in countries with an adequate data protection regime, such as Japan.

Hence, customers can and should prevent transfer of Support Data to third countries. ) Countries of recipients of relevant onward transfer(s): N/a if the contextual alert solution is used. Rationale a) Starting date of the transfer: [Gov org to fill in the date} b) Assessment period in years: 2 c) Ending date of the assessment based on the above: K+? ¢) Target jurisdiction for which the DTIA is made: USA ) Is importer an Electronic Communications Service Provider as defined in USC § 1981(b}(4): f) Does importer/processor commit to legally resist every request for access: Yes i : traditional ond court FISA Section 702, other FISA warrants such as business Ht Since AWS records, pen registers and trap and trace devices, National offers ‘remote computing services’ that ore port of the definition of 'Electranic Communications Service Provider’ Security Letters (secret services) and US Cloud Act, US Stored the por.

'd, sub c, g) Relevant local laws taken into consideration: ce Act (SCA),NSLs FAS, 702. sas the us ‘oppiy. “not* assess the risks warrants. Additionally, mass surveillance / cable interception of Aws coe based on EOP 12333 (mitigated by PPD-28), from their customers. Probability Cases Cates, Rationale per case per year remaining number af year that none of ch the U.S. ‘the uly 2020), the reports nates: Number of cases under the laws listed in Step 2g per year in which an a) authority in the USA is estimated to attempt to obtain relevant data through 0,50 focated outside the United States? legal action during the period under consideration. ‘Nong-" AWS disclosed Suppart or security services. if itaee aes paiae sh Addendum, AWS requests or gagging orders. Share of such cases in which the request occurs in connection with a case b) that due to its nature in principle permits the authority to obtain the data 100% 0,50 also from a provider Additionally, in Clouse 14 of the SCC AWS: The p They hence Probability that in the remaining such cases it will be possible for the Leah velaele nalts oii aimed ' A si c) company to successfully cause the authority (by legal means or otherwise) 509% 0,25 This risk is of | to give up its request for the data in plain text 25 below, 179410141 0016 0680 dq) e) Probability that in the remaining cases the requested data will be provided in one way or another (e.g., with consent or through legal or administrative 25% assistance} Probability that in the remaining cases the authority will consider the data it 1% is seeking to be so important that it will look for another way to obtain it Number of cases per year in which the question of lawful access by a foreign authority arises Number of cases in the period under consideration Legal Basis considered for the following assessment: Prerequisite for success a) b) ¢) qd) e) g) Residual risk of successful lawful access by a foreign authority through the provider (given the countermeasures): Section 702 FISA, other FISA services) and US Cloud Act, US Stored Communications Act (SCA), NSL search warrants.

Probability per case Probability that the authority is aware of the provider and its subcontractors 100% (prerequisite no. 1) Probability that an employee of the provider or its subcontractors will gain access to the data in plain text in a support-case ... (prerequisite 00. 2) 100% ... and is able to search for, find and copy the data requested by the 100% authority (prerequisite na. 3) Probability that despite the technical countermeasures taken, employees of the provider, of its subcontractors or of the parent company technically have access to data in plain text (also) outside a support situation (e.g., using admin privileges) or are able to gain such access, e.g., by covertly installing a backdoor or "hacking" into the system (irrespective of whether they are allowed to do $0) ... (arerequisite no. 2) 100% ... and are then able to search for, find and copy the data requested by the x authority jprerequsite no. 3) Probability that the provider, the subcontractor or its parent company, respectively, is located within the jurisdiction of the authority (prerequisite na. 4) Probability that despite the technically limited access and the technical and organizational countermeasures in place, the authority is permitted to order the provider, its subcontractor or the parent company, respectively, to 50% obtain access to the data and produce it to the authority in plain text (prerequisite no. 5) Probability that if data were to be handed over to the foreign authority, this would lead to the criminal liability of employees of the provider ar its subcontractors, the prosecution of which would be possible and realistic, 80% and as a consequence, the data does not have to be produced or is not Produced (prerequisite no. 6) Probability that the company does not succeed in removing the relevant data in time or otherwise withdrawing it from the provider's access (prerequisite no. 7) 0,00 There is achonce disclose Suppart ite of | Consent from an EU Enterprise Customer is unlikely, in the absence of o date protection adequacy decision fram the European Commission for the USA.

Since AWS is a processor, and not 0 controller for the personal data in the Support Dato, it will take time for the US. AWS to provide j, there wil! be a delay in obtaining an FISA 702 order. Tih i thar it ie nly wit 9 isclosing received a FISA 702 order. tis assumed i i hack invididual blackmaitea/bribed to hand over Support Data. This However the a is i ta support b records, pen r 100,00% 100,00% d trap and National Security Letters (secret ECPA, is and judicially issued and Rationale AWS js a well-known ie i it ial amount: Edu Customers in the 100% A i. Authorised, con wiew, bt rt, Support Dota when necessary for their tasks idem 100% By its nature, Support Data are not encrypted, but they can only be viewed by employees, not exparted idem AWS is a US based company and has access to the Support Dota, even ifthe government organisation uses the for uni hove i by, However 50% in that case oniy the US CLOUD Act applies, it ability compared iti it 's C5 thot ir to personal data from customers. t SO%, even tickets, and not 50% acton custorine ‘onailly, AWS i th There ore no findings in the recent C5:2020 audit about disclosure to authorities ry Addendum, AWS wil requests or gagging orders.

See th: fe above. 5-2020 audit, there 20% were no findings of pli with this policy. Ce seit. rts via AWS Artifc URL: https:/faws.amazon.com/artifact/ IPAWS ar ive a voli or subpoena, AWS may be subjected to gagging order 80% and not permitted to inform its Customer. Hence AWS may not be in a position to issue @ timely warning to its customer that it con ne anger comply with the date protection quarantees in the SCC. 4,00% Legal Basis consi a) 5) ¢) dq) e) for the following Probability in the period Probability that the data at issue is transmitted to the provider or its subcontractors in a manner that permits the telecommunications providers in the country to view it in plain text as part of an upstream monitoring of Internet backbones Probability that the data transmitted will include content picked by selectors (ie., intelligence search terms such as specific recipients or senders of 0% electronic communications) O% Probability that the provider or a subcontractor in the country is technically able to onan ongoing basis search the data in plain text for selectors (i.e. search terms such certain recipients or senders of electronic 0% communications) without the customer's permission as part of a downstream monitoring of online communications Probability that the provider or a subcontractor in the country above may be legally required to perform such as search (alsa) with the company's data Probability that the data is regarded as content that is the subject of 5% intelligence searches in the country as per the above laws 0,00% 0,00% Residual risk of successful lawful access by a foreign intelligence service without any guarantee of legal recourse (in view of the countermeasures): 0,00% 0,00% Section 702 US Foreign intelligence Surveillance Act (FISA), CIA surveillance based on Executive Order (EO) 12333 Rationale AWS opplies encryption to all dato in transit.

AWS opplies encryption to olf data in transit. AWS epplies encryption to all dato in transit. This refers te Upstream Date Caltection. It is not fikely that Support Data fram an EU government organisation are interesting for low ity i] the decrypted and accessed by AWS in the USA if ordered ta do so. However, it is unlikely that Support Data would be of interest, especially if the isi to use identity f fe (see above in 113). Probability that the question of lawful access via the cloud provider will arise at all (1 case in the period = 100%) Probability of successful lawful access by the foreign authorities concerned in these cases despite the countermeasures. Probability of additional successful lawful access by a foreign intelligence service where there is no guarantee of legal recourse (despite countermeasures) Overall probability of a successful lawful access to data in plain text via the cloud provider in the observation period: Description in words (based on Hillson*): The number of years it takes for a lawful access to occur at least once with a 90 percent probability: The number of years it takes for a lawful access to occur at least once with a 50 percent probability: thot bility neither ic decreases over time ( i 179410141 0016 0681 * Scale: <5% = “Very law", 5-10% = “Low’, 11-25 = "Medium", 26-50% = "High" and >50% = "Very high” (by Dawid Hillson, 2005, see https://wwew. ingy/it ibing-probability-timi tural-longuage-7556), a) Estimated | of if if visi: 02% Very Low 4) Estimated impact of risk 3= regular personal data in the clear High Support { Data), urrently admins will faliaw 3 recommendations: (1) ask AWS to apply an internal alert to only give access to EU based @ follow the ijk NOT to 4) Would it be feasible, from a practical, technical and economical point of peseibe why you view, for the data exporter to transfer the personal data in question to a Yes ‘still do nor pursue location in a whitelisted country instead? oa fu. - b) isthe personal data under one of the pursuant to Poona ‘ee applicable data protection law (e.g., Art. 49 GDPR in case of the GDPR)?

‘fapaeat ‘isthe personal data at issue transmitted to the target jurisdiction in clear ne ieciecliat ee text (i.e. there is no appropriate encryption in-transit}? remains encrypted 4) Is the personal data at issue accessible in the target jurisdiction in clear text eign tet by the data importer/recipient or a third party (i.e. the data is either not Yes access is af feast Yes. by appropriately encrypted or access to the keys to decrypt is possible)? Shekel poe e) is the personal data at issue protected by a transfer mechanism approved by the applicable data protection law (e.g., the EU Standard Contractual Ensure thot the mechanism Clauses in case of the GOPR, approved BCR, or - in the case of an onward Yes igi transfer - a back-to-back-contract in line with the EU SCC), and can you ond is complied expect with it, insofar by the target j and with judicial enforcement (where applicable)? Based on the answers given above, the transfer is: | permitted | Final Step: Conclusion In view of the above and the applicable data protection laws, the transfer is: [SIFY rrr Reassess at the latest by: X+2 (or if there are any changes in circumstances) This Transfer Impact Assessment has been made by: Place, Date: SLM Rij / PRIVACY COMPANY Signed: By: [Government org x] 179410141 0016 0682 Data Transfer Impact Assessment (DTIA) on the transfer of Security Data and Trust & Safety Data to AWS in the USA made by ¥ npariy Rijk, CC Heense a) Data exporter (or the sender in case of a relevant onward transfer): Dutch government organisation [X] b) Country of data exporter: ‘Netherlands co) Data importer (or the recipient in case of a relevant onward transfer): Amazon Web.

Ine." i in this DTIA to: "AWS" USA. Seller of Record is Amazon Web Services EMEA SARL ("AWS Europe"), a Luxembourg-based AWS entity. Both AWS and AWS Europe are wholly owned 4 subsidiaries of Amazon.com, Inc. d) Country of data importer: AWS works with Regions, a physical location in a country where data centers are clustered. AWS has Regions in the EU. Each AWS Region consists of a minimum of three, isolated, and physically area. AWS calls each group of logical data centers an Availability Zone. AWS Security Data through the use by admins of Amazon EC2, Amazon $3, and Amazon RDS. The security logs are ribed of the role ‘of AWS as data controller, in stead of processor. The security logs may contain pseudonymous data like IP addresses from visitors if a website is hosted on a VM. However, based on the outcomes of the recent C5:20202 audit, in particular the results of the audit on the OPS-11 basic criterion, AWS was found to only collect and use the Diagnostic Data (including the Security Data) for the 3 purposes of billing, incident not for any type of profiling. e) Context and purpose of the transfer: Bieieany sise receive eemnieints-ar: alerts about its customers activities.

These data are sent to the Trust & Safety Team in the US. Ws pusserciees: i Wie peivecy thatit does not scanning of Customer Cx purposes of or activity except under very limited circumstances (e.g., Amazon Simple Email Service scans a percentage of outgoing emails for SPAM and other types of email abuse in line with industry standards). ‘The relevant AWS team ("AWS Trust «i Safety”}.will Investigate and take appropriate action when It receives an abuse report relating to Customer Content. The complaints may include both Content Data and the actions of employees of the MOJ or any other y that use Amazon EC2, and Amazon RDS to store and process Content Data. f) Categories of data subjects concerned: Employees of the Dutch government, possibly external data subjects that visit websites hosted on AWS: Ifa website is dedicated to special categories of data, such as health data, visitor data captured by AWS are also sensitive data.

If a complaint relates to illegal material, depending on the type of illegality, this could also imply sensitive personal data relating to criminal offences about the admin. g) Categories of personal data transferred: AWS does not engage in proactive detection (: ) of illegal in Amazon EC2, Amazon $3, and Amazon ROS. The T&S team replies to complaints. h) Sensitive and special categories of personal data: The category of Security ( Biatesean te ieed 6 hag an admin or contents by the 3 services abusive, or as a victim of malicious network activity. These data of data. i) Technical implementation of the transfer: Security events and reports about illegal content are collected by AWS's central Network Operations Centre and Trust and Safety team in the USA. tan consider customer and di iy residual perceived risk on data like the IP —— Se ‘atch visitor IP AS AWS personal data, when y its services. in the privacy Dutch to ‘further’ process pel sob tar the ovtpous @aneac echelon» and the security of AWS: customers, AWS and others.

Inthe contract withthe Ouch government, AWS guarentes that its Trust 8 Safety team shal nt dstlose Account information to third parties without the Customer's permission, unless required by law or court order. tf AWS Trust & Safety has a legal Account te third Parties, it will notify Customer, unless prohibited from doing so by law or a court order. AWS that it has not created any or similar in the Services id be used by AWS or by third parties to obtain system and/or inthe i} Technical and organizational measures in place: AWS adds: AWS Artifact is the central resource for it provides d eports from AWS and 1SVs who sell their products on AWS Marketplace. AWS offers distinct solutions cust s and partners ( to AWS accounts and for adding federation support to customer's end-user-facing web and mobile AWS used open identity including Security Assertion (Markup Language 2.0 (SAML 2.0), Open ID Connect (IDC), and OAuth 2.0.

References: Ha J Io f hittps://aws.amazon.com/artifact/ Hy fi i k) Relevant onward transfer(s) of personal data (if any): ‘Not applicable |) Countries of recipients of relevant onward transfer(s): Nia Rationale a) Starting date of the transfer: [Gav org to fill in the date] b) Assessment period in years: 2 c) Ending date of the assessment based on the above: M+z d) ‘Target jurisdiction for which the DTIA is made: ‘USA e) is importer an Electronic Communications Service Provider as defined in USC Yes § 18821(b)(4): Yes Does importer/processor commit to legally resist every request for access : g) Relevant local laws taken into consideration: FISA 702, FISA such as busi traditional low enforcement, and court: Security Letters (secret services) and US Cloud Act, US Stored of the 4, sub c, fe Act (SCA),NSLs i 1. toAWS hosed 702. and i and search the us Act ond US CLOUO Act apply. This OTIA does *not* assess the risks warrants. cable of requests Aws aa is EOP 1 ie i from their customers.

Probability Cases Cases Rationale per case per year remaining The number of aws that none of | 5. Enterprise 2020), the reports nates: Number of cases under the laws listed in Step 2g per year in which an 5. a) —_ authority in the USA is estimated to attempt to obtain relevant data through 0,50 located outside the United States? legal action during the period under consideration. pearl the historical date available based Share of such cases in which the request occurs in connection with a case b) ‘that due to its nature in principle permits the authority to obtain the data 100% 0,50 also from a provider the AWS Trust & Safety nicht tiie ire court PAWS Probability that in the remaining such cases it will be possible for the Trust & to disclose Customer, co) company to successfully cause the authority (by legal means or otherwise) 0% 0,50 by low or . Both the to give up its request for the data in plain text for. bepeess persona! dato in plain text. 179410141 0016 0683 There is a chance that AWS is compelled ta disciase Security Data ar data foam the T&S team.

AWS's public Probability that in the remaining cases the requested data will be provided it to resist such discias Iv apply which AWS acts as d) in oné way of another (e.g., with consent or through legal or administrative 100% 0,00 processor, not to these personal date. However, as noted in 33F above, AWS does commit to resist ond inform. assistance) Consent from an EU Enterprise Customer is unlikely, in the absence of a data protection adequacy decision from the Eurapean Commission for the USA. Probability that in the remaining cases the authority will consider the data it Dote about security incidents, or toseek e) 10% 0,00 0,00 aos . is seeking to be so important that it will look for another way to obtain it access thnaugh anathee army. Number of cases per year in which the question of lawful access by a foreign authority arises 0,00 Number of cases in the period under consideration 0,00 Section 702 FISA, other FISA warrants such as business records, pen registers and trap and trace devices, National Security Letters (secret Legal Basis consi for the following services) and US Cloud Act, US Stored Communications Act (SCA), ECPA, adminis ind judicially and search warrants.

Prerequisite for success Probability per case Rationale Probability that the authority is aware of the provider and its subcontractors AWS is a well-known it ider with ial amaunt of is Edu Customers in the a) 100% 100% (prerequisite no. 1) Eu b) Probability that an employee of the provider or its subcontractors will gain 00 ‘eis _ ‘6 y and T&S Data as for their access to the data in plain text in a support-case ... (prerequisite no. 2) ica ... and is able to search for, find and copy the data requested by the 100% item authority prerequisite na. 3) Probability that despite the technical countermeasures taken, employees of idem. in the privacy the Dutch thot the Trust & Sofety team shall the provider, of its subcontractors or of the parent company technically 100% ns pa rane . i ird parti recent ecaeer's permission, = rouble ia olad 4 discatt r rrust & Safety to jes, it wi ) have access to data in plain text (also) outside a support situation (e.g., 50% Gs ule A Tard - coat: dine thot thas aot using admin privileges) or are able to pain such access, e.g., by covertly, 50,00% purposefully created aay “backsloars” ar sienilor ices that be used by AWS or by installing a backdoor or "hacking" into the system (irrespective of whether third par ir access to the sy Personal Data stored in the system.

There are they are allowed to do $0) ... (prerequisite no. 2) no findings of non-compliance with the access rules in the recent C5:20202 audit. ». and are then able to search for, find and copy the data requested by the 100% tom authority (prerequisite na. 3) d) Fropability, Rha the provides, the Sun CORT SCT cor its parent company, 100% 100 pene heantece bl and T&S Dato, ice cies ail respectively, is located within the jurisdiction of the authority joreequisirs no. 4) Probability that despite the technically limited access and the technical and organizational countermeasures in place, the authority is permitted to order “ii . ah ren a ‘conc ii toes *) the provider, its subcontractor or the parent company, respectively, to 7 100% controls ausited. There are no findings in the recent €5:2020 audit abaut disclasure to authorities. obtain access to the data and produce it to the authority in plain text (prerequisite no. 5) Probability that if data were to be handed over to the foreign authority, this would lead to the criminal liability of employees of the provider ar its According to the mast recent C5-2020 audit, there were no findings of ipl icy. f) subcontractors, the prosecution of which would be possible and realistic, 80% 20% and as a consequence, the data does not have to be produced or is not Produced (prereauisite no. 6) Custamers can access these audit reports via AWS Artifact, URL: https://aws.omazon.com/artifact/ PAWS receis ‘subpoena, y ibje' to gagging order.

As qui in F48 Probability that the company does not succeed in removing the relevant above, AWS contractually commits not to disci ion to third partie the Customer's 8) data in time or otherwise withdrawing it from the pravider's access 100% 100% permission, unless required by low or court order. If AWS Trust & Safety has @ legal obligation to disclose (prerequisite 00. 7) Account Information to third parties, it will notify Customer, ibited from doing so by i order. Residual risk of successful lawful access by a foreign authority through the provider (given the countermeasures): 20,003 Legal Basis i for the i Section 702 US Foreign Intelligence Surveillance Act (FISA), CIA surveillance based on Executive Order (EO) 12333 Probability in the period Rationale Probability that the data at issue is transmitted to the provider or its subcontractors in a manner that permits the telecommunications providers in the country to view it in plain text as part of an upstream monitoring of Internet backbones 0,00%.

Probability that the data transmitted will include content picked by selectors b) (Le., intelligence search terms such as specific recipients or senders of 0% AWS applies encryption to all data in transit. electronic communications} a) 0% AWS opplies encryption to all dato in transit. Probability that the provider or a subcontractor in the country is technically able to on an ongoing basis search the data in plain text for selectors (i.e. c) search terms such certain recipients or senders of electronic 0% communications) without the customer's permission as part of a downstream monitoring of online communications AWS opplies encryption to all dato in tronsit. 0,002 ‘ F This refers te Upstream Data Collection. it is possible that same Securityand T&S Data relating to an EU ¢) Probability that the provider or a subcontractor in the country above may be 50% pe wi ascidian cine a ting far prtnrs . legally required to perform such as search (also) with the company's data nature of the illegal content or the type of security breach.

P Probability that the data is regarded as content that is the subject of 50% nae intelligence searches in the country as per the above laws Residual risk of successful lawful access by a foreign intelligence service without any guarantee of legal recourse (in view of the 0,00% countermeasures): Probability that the question of lawful access via the cloud provider will arise at all (1 case in the period = 100%) 0,00% Probability of successful lawful access by the foreign authorities concerned in these cases despite the countermeasures: 20,00% Probability of additional successful lawful access by a foreign intelligence service where there is no guarantee of legal recourse (despite 0.00% countermeasures) a Overall probability of a successful lawful access to data in plain text via the cloud provider in the observation period: | 000% | Description in words (based on Hillson*): Very low 179410141 0016 0684 The number of years it takes for a lawful access to occur at least once with a 90 percent probability: The number of years it takes for a lawful access to occur at least once with a SO percent probability: oo _.@ssuming that the probability neither increases nor decreases over time (like tassing a coin) * Scale: <5% = "Very low", 5-10% = “Low”, 11-25 = "Medium", 26-50% = “High” and >50% = "Very high" (by David Hilison, 2005, see https: ri ingyi ibing probability: tura-Janguage-7556).

Rationale a) Estimated pr lity of vf risk: 0.00% Very Low 4) Estimated impact of risk 32 regular personal doto in the clear High ifthe ity a in the EU orwas it i network activity, this in turn may lead to the pracessing of speciol categories of personal date about the admins} of the VM, or EC2-hosted website. AWS or third parties may then take steps to re-identify the responsible admin{s) or wehsite visitors based an the pseudonymous data in the security events. Very High Medium Low Very Low Rationale a) Would it be feasible, from a practical, technical and economical point of Describe why you view, for the data exporter to transfer the personal data in question to a Yes still donot pursue AWS processes the Security Data ond T&S data in the USA, and does not have an EU based Trust & Safety Team location in a whitelisted country instead? Ponte b) Is the personal data transferred under one of the exemptions pursuant to Mackey thet thee A : z Yes prerequisites are Mo. applicable data protection law (e.g., Art. 49 GDPR in case of the GDPR)? falftted! cc) is ‘ .

Is the personal data atissue transmitted to the target jurisdiction in clear Ensure thot data Dota in transit ore encrypted by AWS (SSL/TLS). text (i.e. there is no appropriate encryption in-transit)? remains encrypted d) Is the personal data at issue accessible in the target jurisdiction in clear text Foreign lawful Yes. The Security & TRS in the lear: inthe He by the data importer/recipient or a third party (i.e. the data is either not Yes access is at least pemmitted access Pe appropriately encrypted or access to the keys to decrypt is possible)? techalcally possible e) Is the personal data at issue protected by a transfer mechanism approved by the applicable data protection law (e.g., the EU Standard Contractual Ensure that the awe contract . - Se Sacoti Cie five Sti wehowe a mechanism 05 controller contractually commits nat to disclose the Secu ta a parties without Clauses in case of the GDPR, approved BCR, or - in the case of an onward Yes aiee : ion. ff valid ecier, with & ig eli strane quali transfer - a back-to-back-contract in line with the EU SCC), and can you and is complied incidental. expect compliance with it, insofar permitted by the target jurisdiction, and with judicial enforcement (where applicable}? . should opp ity fi he Account Data far employees whose identity should remain Based on the answers given above, the transf permitted confidential Final Step: Conclusion In view of the above and the applicable data protection laws, the transfer is: acGnck ae at yt 5 (or if there are any changes in circumstances) This Transfer Impact Assessment has been made by: Place, Dat SLM Rijk / PRIVACY COMPANY Signed: By: [Government org X] 179410141 0016 0685 Data Transfer Impact Assessment (DTIA) on the transfer of Admin Account Data to AWS in the USA k) ) Data exporter (or the sender in case of a relevant onward transfer): Country of data exporter: Data importer (or the recipient in case of a relevant onward transfer): Country of data importer: Context and purpose of the transfer: Categories of data subjects concerned: Categories of personal data transferred: Sensitive and special categories of personal data: Technical implementation of the transfer: Technical and organizational measures in place: Relevant onward transfer(s) of personal data (if any): Countries of recipients of relevant onward transfer(s): ™ made by Privacy Company ijk, using cc icense Seer esa cena d Sisto SGA toate a Luxembourg-based AWS entity.

Both AWS and AWS Europe are wholly owned subsidiaries of Amazon.com, Inc. AWS works with Regions, a physical location in a country where data centers are clustered. AWS has Regions in the EU. Each AWS Region consists of a minimum of three, isolated, and AZs within area. AWS calls each group of logical data centers an Availability Zone. Account Data from employee admins of the MOI or any other Governmental entity that use Amazon EC2, Amazon $3, and Amazon RDS to stare and process Content Data ‘of the Dutch also form part of Diag: and included requests. See the separate tabs in this DTIA for the Support Data and Diagnostic Data Account! may if works for with a high level of sensitivity, or if the employee is a VIP. Admins. that with sensitive targets of if their identity is leaked. Account Data may be stored in the United States ok teeta Steele aes op cc a Ld of audits. Unt \ahisete available for customers.

This OTIA assumes g admin data by ek sabe nara its Customer. If disclose toa Party, AWS wil (i) promptly notify Customer of the Request to allow Customer to seek a protective order or other appropriate remedy, if AWS is legally do so. If AWS is from notifying Customer about the Request, AWS will use all reasonable and lawful efforts to obtain a waiver of to allow AWS to much information to Customer as soon as possible; and (ii) challenge any overbroad or inappropriate Request (including where such Request conflicts with the law of the European Union or applicable Member State law). Admins can and should pseudonymise their Account Data (collected in the Diagnostic Data). AWS offers solutions to fede: 's and partners (workforce) to AWS accounts and business applications, and offers federation support to customer's end-user-facing web and mobile applications. AWS :npahibe auc dente atehiadland ealorneg including Security Assertion Markup Language 2.0 (SAMIL 2.0), Open ID Connect (O!DC}, and OAuth 2.0.

URL: Hfa AWS applies yption to all data in transit. SLM Rijk and AWS have signed the new Controller to Processor SCC. nthe contract with he Dutch government AWS grates that ta ot purposeful crested 3y “backdoors” or similar programming in the Services that could be used by AWS or by third parties to obtain to the sy: in the system, Addi AWS effort to, Account Data to its Customer. if compelled to disclose Personal Data to a Requesting Party, [AWS well {f] promptly natlly Customer of thé Request to allée Customer ts eeeka pidtective order or thier spardpriate remedy, ‘if AWS is legally permitted to do so. If AWS is prohibited from notifying Customer about the Request, AWS will use all reasonable and lawful efforts to obtain a waiver of prohibition, to allow AWS: to as much Customer as soon as possible; ew rb appr Request (including where such Request conflicts with the law of Union or Member Not applicable [apart from Support Data, see separate tab] Starting date of the transfer: Assessment period in years: Ending date of the assessment based on the above: Target jurisdiction for which the DTIA is made: is importer an Electronic Communications Service Provider as defined in USC ves § 1881(b)(4): Does imparter/processor commit to legally resist every request for access : Relevant local laws taken into consideration: Rationale {Gov org to fill in the date] a2 ‘USA Yes risks of | tow and court FISA Section 702, other FISA warrants such as business vas Since AWS records, pen registers and trap and trace devices, National offers . i .

Security Letters (secret services) and US Cloud Act, US Stored the US Code por. 4, 3ub 6, engage 42333 a2. d search the US ‘pply. This DTIA does fcable af requests warrants. ‘based on EOP 12333 (mitigated by PPD-28}, Probabili lity Cases Cases Rationale per case per year remaining of 0.5 ‘year that none of the subpoenas, tothe us. 2026), the reports nates: Number of cases under the laws listed in Step 2g per year in which an dota a) —_ authority in the USA is estimated to attempt to obtain relevant data through 050 located outside the United States? legal action during the period under consideration. Luca : services. / ate the beso Addendum, AWS requests or gagging challenged: demands for customer Share of such cases in which the request occurs in connection with a case decisic b) that due to its nature in principle permits the authority to obtain the data 100% 0,50 also from a provider addendum-to-the-aws-dpo. pdf.

Additionally, in Clause 14 of the SCC. A Probability that in the remaining such cases it will be possible for the inthe c) company to successfully cause the authority (by legal means or otherwise) 100% 0,00 to give up its request for the data in plain text Th that an ility that in the ing cases the data will be provided Sp) Eater atta Sintoreer ents ree Fin d) in one way or another (e.g., with consent or through legal or administrative 25% 0,00 Data, it will take time far aaa Re ‘ it Ch il assistance) be a delay in obtaining an FISA 702 order. This delay i comply with SCC. i 702 order. el Probability that in the remaining cases the authority will consider the data it 10% 0,00 0,00 hii ing? cnc lal: for the is seeking to be so important that it will look for another way to obtain it be minimised by using identity federation). Number of cases per year in which the question of lawful access by a foreign authority arises 0,00 Number of cases in the period under consideration 0,00 179410141 0016 0686 179410141 Section 702 FISA, other FISA warrants such as business records, pen registers and trap and trace devices, National Security Letters (secret Legal Basis i for the following services) and US Cloud Act, US Stored Act (SCA), on ECPA, and judicially and search warrants.

Prerequisite for success Probability per case Rationale a) Probability that the authority is aware of the provider and its subcontractors 100% 100% by i oe (prerequisite ao. 1) Probability that an employee of the provider or its subcontractors will gain " b) 50% Dato. However, if an admin corresponds with o support employee, itis plausible that names and contact dota access to the data in plain text in a support-case ... (prerequisite no. 2) are exchanged. 49,00% ... and is able to search for, find and copy the data requested by the 50% Sai authority (prerequisite no 3) Probability that despite the technical countermeasures taken, employees of 49% only of in, but it possible that AWS i¢ able to the provider, of its subcontractors or of the parent company technically ambine c) have access to data in plain text (also) outside a support situation (e.g., 25% Dotan by WS AWS using admin privileges) or are able to gain such access, e.g., by covertly 0,002 installing a backdoor or “hacking” into the system (irrespective of whether .. and are then able to search for, find and copy the data requested by the authority jpcerequisite no. 3) * 4) Probability that the provider, the subcontractor or its parent company, 100% 100% ‘Data that may be the respectively, is located within the jurisdiction of the authority {prerequisite no. 4) ility that despite the limited access and the technical and organizational countermeasures in place, the authority is permitted to order e) the provider, its subcontractor or the parent company, respectively, to 100% 100% ia obtain access to the data and produce it to the authority in plain text (prerequisite no. 5) Probability that if data were to be handed over to the foreign authority, this would lead to the criminal liability of employees of the provider or its Aditnadte, 0 f) subcontractors, the prosecution of which would be possible and realistic, 80% 20% + ike ae at . = * were no findings of non-compliance with this policy.

Customers AWS Artifact, and as a consequence, the data does not have to be produced or is not URL: produced (prerequisite no. 6) Probability that the company does not succeed in removing the relevant ig ‘subpoena, a) data in time or otherwise withdrawing it from the provider's access 100% 100% Hence i ir ‘con (prerequisite no. 7) no longer comply with the dota protection guarantees in the SCC. Residual risk of successful lawful access by a foreign authority through the provider (given the countermeasures): 9,80% Legal Basis consi for the following Section 702 US Foreign Act (FISA), CIA based on (£0) 12333 Probability in the period Rationale Probability that the data at issue is transmitted to the provider or its a) Subcontractors in a manner that permits the telecommunications providers 0% a a a in the country to view it in plain text as part of an upstream monitoring of ne Internet backbones 0,00% Probability that the data transmitted will include content picked by selectors b) (ie., intelligence search terms such as specific recipients or senders of 0% idem electronic communications) Probability that the provider or a subcontractor in the country is technically able to on an ongoing basis search the data in plain text for selectors (i.e. ¢) search terms such certain recipients or senders of electronic 0% 0,00% Idem communications) without the customer's permission as part of a downstream monitoring of online communications 0,006 Calfection 4) Probability that the provider or a subcontractor in the country above may be SOK ondfar However, it is legally required to perform such as search (alsa) with the company's data fotiow identity federation. ie considered e) Probability that the data is regarded as content that is the subject of 5% intelligence searches in the country as per the above laws the Residual risk of successful lawful access by a foreign intelligence service without any guarantee of legal recourse (in view of the 0 countermeasures): Probability that the question of lawful access via the cloud provider will arise at all (1 case in the period = 100%) 0,00% Probability of successful lawful access by the foreign authorities concerned in these cases despite the countermeasures 9,80% Probability of additional successful lawful access by a foreign intelligence service where there is no guarantee of legal recourse (despite ° countermeasures) Overall probability of a successful lawful access to data in plain text via the cloud provider in the observation period: | 000% | Description in words (based on Hillson*): Very low The number of years it takes for a lawful access to occur at least once with a 90 percent probability: oo The number of years it takes for a lawful access to occur at least once with a 50 percent probability: oo hii i fi i in) * Scale: <5% = "Very law", 5-10% = "Low", 11-25 = "Medium", 26-50% = High” and >50% = "Very high" (by David Hillson, 2005, i. ing fi ibis ility-Hienitatie turat-language-7556}.

Rationale 9) _ Estimated probability of occurance of successful awful access risk: 0,00% Very Low 4) Estimated impact of risk 3= regular personal data in the clear High 0016 0687 i') iL 2 Define the safeguards in place a) Would it be feasible, from a practical, technical and economical point of wiew, for the data exporter to transfer the personal data in question to a Yes location in a whitelisted country instead? b) is the personal data transferred under one of the exemptions pursuant to applicable data protection law (e.g., Art. 49 GDPR in case of the GDPR)? ¢) Is the personal data at issue transmitted to the target jurisdiction in clear No text (Le. there is no appropriate encryption in-transit)? Is the personal data at issue accessible in the target jurisdiction in clear text by the data importer/recipient or a third party (i.e. the data is either not Yes appropriately encrypted or access to the keys to decrypt is possible)? e) Is the personal data at issue protected by a transfer mechanism approved by the applicable data protection law (e.g., the EU Standard Contractual Clauses in case of the GDPR, approved BCR, or - in the case of an onward transfer - a back-to-back-contract in line with the EU SCC), and can you expect compliance with it, insofar permitted by the target jurisdiction, and judicial enforcement (where applicable)?

Describe why you ‘still do not pursue this aptian Ensure thot data remains encrypted Foreign lowful access is at least technically possible Based on the answers given above, the transfer permitted Final Step: Conclusion In view of the above and the applicable data protection laws, the transfer is: This Transfer impact Assessment has been made by: SLM Rijk / PRIVACY COMPANY 179410141 Place, Date: Signed: The risk assessment assumes the Customer will for employ rf accounts Rationale AWS does nat offer EU geolocolisation for Account Data Date in transit ore encrypted by AWS (SSL/TLS). Admins their (collected in the service generated server logs} with identity federation. Recommendation to admins ta pseudonymise admin Account Data with identity federation. All traffic over the internet is protected by encryption in transit (SSL/TLS). Yes. The Account Dato con bi d in the clear by when they ore permitted ond by the support employees that are permitted te work with Support Data.

SLM Rijk and AWS have signed the new SCC Controller to Pracessor. Reassess at the latest by: X+2 (or if there are any changes in circumstances) By: [Government org X] 0016 0688 Data Transfer Impact Assessment (DTIA) on the transfer of restricted access Website Data to AWS in the USA 1h made by Privacy Company Rij, sing clea a) Data exporter (or the sender in case of a relevant onward transfer): ‘Dutch government organisation [x] b) Country of data exporter: ‘Netherlands ¢) Data importer (or the recipient in case of a relevant onward transfer): Amazon Web Services, Inc. ("AWS, Inc.", abbreviated in this DTIA to: "AWS") USA. Seller of Record is Amazon Web Services EMEA SARL ("AWS Europe"), a Luxembaurg-based AWS entity. Both AWS and AWS Europe are whally owned subsidiaries of Amazon.com, Inc. Pe enn ae een cmc er Dolmen geet agit fa mini of d) =~ Country of data importer: three, isolated, and physi each group of logit center e) Context and purpose of the transfer: Employee admins that necessarily have to use ' si: salen oareane torsion ees tbe a eopsagto naision ETS atrceaw Sacyonl aceon eimiaersoes f) Categories of data subjects concerned: Employees of the Dutch government: e) Categories of personal data transferred: PRE wD aa a a d device and IP h) Sensitive and special categories of personal data: dlinth-eoreeclang sentasinds np!

‘ity remain i) Technical implementation of the transfer: Website Diagnostic Data may be generated in the region where the website is accessed or deployed, and depending on the scope of the customer's interactions, Website Data may be stored in or accessed from multiple countries, including the United States. D Technical and organizational measures in place: AWS has elaborate and has its tested in diffe ypes of audits. T are available for Additionally, AWS commits to use every reasonable effort to redirect valid and binding orders for Website Data to its Customer. If compelled to disclose personal sata ‘to a Requesting Party, AWS will (i) promptly notify Customer of the Request to allow Customer to seek or other remedy, if AWS is legally permitted to do so. Henan prc had fram noting Cvctorver sien tte Remmvests As Ot Le a reson eed Moeiul etrenCy ince earat to allow AWS ustomer as soon as possible; and (ii) challenge any Request where such Request conflicts with the law of the European Union or applicable Member State law). k) Relevant onward transfer(s) of personal data (if any): AWS sets essential, functional, and performance cookies.

Even though its cookie policy suggests the use of advertising cookies, AWS does not set advertising or third Dias comme sh rd cole isms 6 Seca a ene Hic AWS cate, Keegy wie ulin ng accinate: ty eroti Wy ECE SEs ae MEE Garvie rariogeenete Admins are advised to always use level of I) Countries of recipients of relevant onward transfer(s): nfa Rationale a) Starting date of the transfer: [Gav org to fill in the date] b) Assessment period in years: 2 c) Ending date of the assessment based on the above: M42, d) ‘Target jurisdiction for which the DTIA is made: ‘USA e) Is importer an Electronic Communications Service Provider as defined in USC Yes § 1881(b)(4): f) Yes Does importer/processor commit to legally resist every request for access : a) Relevant local laws taken into consideration: of prepay FISA Section 702, other FISA warrants such as business os well as secret Since AWS records, pen registers and trap and trace devices, National offers that ier’ Security Letters (secret services) and US beara US Stored the ec Act (SCA),NSL CPA, ngage 12333 to AWS. 702. d search the US Act and US CLOUD Act apply.

This OTIA does *not* assess the risks Wratten: omni: I cable it requests. AWS based on EOP 12333 (mitigated by PPD-28}, EOP. any from their customers. Probabilit ba bility Cases Cases fiadionsie per case per year remaining a) Number of cases under the laws listed in Step 2g per year in which an The number of 0,5 case per year authority in the USA is estimated to attempt to obtain relevant data through af wnee - ‘uly legal action during the period under consideration. the in the of located outside the United States? 0,50 None." AWS does nat provide specific if Website Data ‘security services. See: data available and. based zero. b) Share of such cases in which the request occurs in connection with a case Addendum, AWS that due to its nature in principle permits the authority to obtain the data Requests Ar gagging enders also from a provider 100% 0,50 in Clause 14 of the SCC AWS ) Probability that in the remaining such cases it will be possible for the The Website the clear, company to successfully cause the authority (by legal means or otherwise) : = peeaiiee eines Bate to give up its request for the data in plain text 1 045 im plain text, an spite of a) Probability that in the remaining cases the requested data will be provided in one way or another (e.g., with consent or through legal or administrative (Eis Eotergaise.

Gastar St nileety in Pie mi a USA. Since, for the pe jn the restricted! assistance) 259% 034 it pat rom there will be a delay 702 order. slay AWS to comply with SCC. FISA 702 order. e) Probability that in the remaining cases the authority will consider the data it is seeking to be so important that it will look for another way to obtain it 10% 0,03 0,03 blackmailed/bribed to hand over Website Date. This cannat be excluded. Number of cases per year in which the question of lawful access by a foreign authority arises 0,03 Number of cases in the period under consideration 0,07 Secuon AE NEA. other FR uch as busi cords, registers and trap and trace devices, National Security and US Cloud Act, US Stored Act (SCA), NSLs based on ECPA, administrative and judicially issued subpoenas, and search warrants. Legal Basis consi for the following Prerequisite for success Probability per case Rationale a) Probability that the authority is aware of the provider and its subcontractors (prerequisite no. 1) 100% 100% eu b) Probability that an emplayee of the provider or its subcontractors will gain A necessory for their tasks, access to the data in plain text in a support-case ...

(prerequisite no. 2} 50% boguaedana feat cicero ar adit 49.00% 179410141 0016 0689 ... and is able to search for, find and copy the data requested by the a tem authority \orereguisite no. 3) 50% cd Probability that despite the technical taken, lay of their the provider, of its subcontractors or of the parent company technically 62% ity have access to data in plain text (also) outside a support situation (e.g., raise using admin privileges) or are able to gain such access, e.g., bycovertly 50% installing a backdoor or "hacking" into the system (irrespective ofwhether 25,006 Aws they are allowed to do So) ... (prerequisite ne. 2) Stored in the system. ndings of non-complionce with the C5:20202 audit «and are then able to search for, find and copy the data requested by the 50% dem, authority (prerequisite no. 3) d) Probability that the provider, the subcontractor or its parent company, the respectively, is located within the of the authority joe ay 100% 100% e) Probability that despite the technically limited access and the technical and Though 100%, AWS has organizational countermeasures in place, the authority is permitted to order a ‘the provider, its subcontractor or the parent company, respectively, to 100%. 100% obtain access to the data and produce it to the authority in plain text (prerequisite no. 5) f) Probability that if data were to be handed over to the foreign authority, this Addendum, would lead to the criminal liability of employees of the provider or its aan mats, dave ‘subcontractors, the prosecution of which would be possible and realistic, 80% 20% ‘eis ‘https://oars amazon.com/artifact/ and as a consequence, the data does not have to be produced or is not Produced |prenequisite no. 6) 2) —- Probability that the company does not succeed in removing the relevant may data in time or otherwise withdrawing it from the provider's access Kprerequisite no. 7] 100%. 100% Residual risk of successful lawful access by a foreign authority through the provider (given the countermeasures): 12,35% Legal Basis considered for the following assessment: Section 702 US Foreign Act (FISA), CIA based on Executive Order (EO) 12333 Probability in the period Rationale a) Probability that the data at issue is transmitted to the provider or its oN AWS applies encryption to ail data in transit. subcontractors in a manner that permits the telecommunications providers in the country to view it in plain text as part of an upstream monitoring of Internet backbones 0,00% b) —- Probability that the data transmitted will include content picked by selectors 0% AWS applies encryption to all data in transit.

(Le., intelligence search terms such as specific recipients or senders of electronic communications) c) Probability that the pravider or a subcontractor in the country is technically o% AWS applies encryptian to all data in transit. able to on an ongoing basis search the data in plain text for selectors (i.e. search terms such certain recipients or senders of electronic 0.00% communications) without the customer's permission as part of a downstream monitoring of online communications 0,00% d) Probability that the provider or a subcontractor in the country abave may be 10% itis Website eu legally required to perform such as search (also) with the company's data ace eee dega! legally req ps (also) pany : e) Probability that the data is regarded as content that is the subject of 5% Website Bata fo go intelligence searches in the country as per the above laws Hy siln, but Residual risk of successful lawful access by a foreign intelligence service without any guarantee of legal recourse (in view of the countermeasures): 0,00% Probability that the question of lawful access via the cloud provider will arise at all (1 case in the period = 100%} 6,75% Probability of successful lawful access by the foreign authorities concerned in these cases despite the countermeasures 12,35% Probability of additional successful lawful access by a foreign intelligence service where there is no guafantee of legal recourse (despite countermeasures) 0,009 Overall probability of a successful lawful access to data in plain text via the cloud provider in the observation period: | 83x | Description in words (based on Hillson*): Very low The number of years it takes for a lawful access to occur at least once with a 90 percent probability: oo ‘The number of years it takes for a lawful access to occur at least once with a 50 percent probability: oo ~ Ossuming that the probability neither increases nor decreases over time (like tossing a cain} * Scale: <S% = "Very low", S-10% = “Low”, 11-25 = "Medium", 26-SO% = "High" ond >50% = “Very high" (by Oavid Hillson, 2005, i w ing -probatsility leit ural 7556) Rationale a) Would it be feasible, from a practical, technical and economical point of Yes stored | view, for the data exporter to transfer the personal data in question to a (Deeseative mek os bd location in a whitelisted country instead? reine cial b) Is the personal data transferred under one of the exemptions pursuantto No Use of applicable data protection law (e.g., Art. 49 GDPR in case of the GDPR)?

‘Structural, not-an incidental data transfer c) Is the personal data at issue transmitted to the target jurisdiction in clear = No ‘Ensure thot dato text (i.e. there is no appropriate encryption in-transit)? ‘remains encrypted ‘the internet ts protected-by encryption in transit (SSC/TLS). 179410141 0016 0690 d) Is the personal data at issue accessible in the target jurisdiction in clear text Yes Yes. Th be din the clear by AWS when they are permitted access by the data importer/recipient or a third party (i.e. the data is either not Foreign lawful appropriately encrypted or access to the keys to decrypt Is possible}? promise technically e) Is the personal data at issue protected by a transfer mechanism approved Yes SLIM Rijk and AWS have signed the new SCC Controller ta Processor, by the applicable data protection law (e.g., the EU Standard Contractual Ensure that the Clauses In case of the GDPR, approved BCR, or - in the case of an onward Peep transfer - a back-to-back-contract in line with the EU SCC), and can you and is complied with expect compliance with it, insofar permitted by the target jurisdiction, and judicial enforcement (where applicable)?

Based on the answers given above, the transfer is: permitted Final Step: Conclusion In view of the above and the applicable data protection laws, the transfer is: [YT Ty ne Reassess at the latest by: X+2 (or if there are amy changes in circumstances} This Transfer impact Assessment has been made by: Place, Date: SLM Rijk / PRIVACY COMPANY Signed: By: [Government org x] 179410141 0016 0691