A Path Forward – Draft Guidance Published For Dealing With International Data Transfers Post-Schrems II

This week saw the publication of draft guidance by the European Data Protection Board and draft standard contractual clauses by the European Commission to address international data transfer concerns in the wake of Schrems II. We take a closer look.

In the wake of the decision of the Court of Justice of the European Union (CJEU) in Schrems II, controllers and processors have been working closely with legal advisors to find a compliant way to transfer personal data outside of the European Economic Area (EEA).

As discussed in our article here, the CJEU found in Schrems II that the validity of Standard Contractual Clauses (SCCs), the popular model contract many companies rely upon to transfer personal data outside of the EEA, may require "supplementary measures" in certain instances where the laws of the transfer destination country do not afford a "level of protection essentially equivalent" to that guaranteed within the EU by the GDPR.