The EU's New Privacy Rules: The Promise And Peril For US Data Processors

The European Union's General Data Protection Regulation (GDPR) prohibits transfers of personal information about Europeans to destinations outside of the EU unless one of several tests is satisfied. As pertains to transfers of information to the United States, the most common bases for such data transfers are (1) express consent of the individual, (2) necessity for the performance of a contract with the individual, and (3) standard contractual clauses (SCCs) adopted by the European Union.

In many cases, US companies provide back-end services to large organizations with operations in the EU. Those large organizations routinely ask the service companies to agree to the SCCs in order to comply with the GDPR.