Summary
On July 16, 2020, the Court of Justice of the European Union
(CJEU) invalidated in "Schrems II" the EU–U.S.
Privacy Shield framework, while upholding the Standard Contractual
Clauses (SCCs) as a valid mechanism for international data
transfers under certain conditions. For international data
transfers, the EU GDPR distinguishes between (a) outbound transfers
of personal data to countries outside the European Economic Area
(EEA) which offer an adequate level of data protection and (b)
transfers to such countries without adequate protection.
This FAQ gives an overview of the transfer options still
available following the Schrems II decision.
A Formal Adequacy Decision: If the third
country provides an adequate level of data protection and the
European Commission issues an 'adequacy decision', then
personal data can be transferred to that third country on the same
basis as a transfer from one EU country to another. Currently,
adequacy decisions exist for
