The pace at which global privacy laws and guidance are evolving
has not slowed during the 2019 novel coronavirus (COVID-19)
pandemic, especially with respect to the General Data Protection
Regulation (GDPR). European data regulators have issued additional
guidance for businesses that transfer personal data out of the
European Economic Area in light of this summer's Schrems
II ruling.
On July 16, 2020, the European Court of Justice issued a ruling
(Schrems II) that invalidated the EU-US Privacy Shield on which
many companies relied to transfer their data between the US and EU.
The Schrems II ruling did not invalidate the use of Standard
Contractual Clauses (SCCs) as a global data transfer mechanism but
did create some uncertainty around their use. The ruling held that
SCCs may only be relied upon if the safety of EU
citizens' data can be guaranteed. What that meant and how that
could be accomplished was subject to much discussion and debate
until last month, when the
