German DPAs Launch Audit Of International Data Transfers After Schrems II

According to a press release of the data protection authority (DPA) of Lower Saxony earlier this month, nine German DPAs will participate in a coordinated audit of companies in Germany regarding their transfers of personal data to countries outside the European Economic Area (EEA). The new initiative aims at broadly enforcing the requirements set forth by the Court of Justice of the European Union (CJEU) in its Schrems II decision of almost 11 months ago. The DPAs will contact an unspecified number of companies under their supervision with aligned questionnaires. Each DPA decides independently in which areas it will take action and whether the questionnaires should be regionally adapted. Separately, on June 22, 2021, the DPA of Hesse informed companies and public authorities in Hesse that transfers of personal data to third countries like the U.S. are not permissible without additional safeguards. Companies have to demonstrate that they have carried out the required