EU-US Privacy Shield And Schrems II - What Now For International Data Transfers?

Last month, the European Court of Justice dealt a major blow to organisations that transfer personal data to the US with the striking down of the EU-US Privacy Shield. What's next for UK companies who are exporting personal data to the US and beyond?

The Legal Background

Under data protection law in the UK, organisations cannot transfer personal data outside of the UK or the EEA without ensuring that the personal data is safeguarded in the same way that it would be if it remained in the EEA. There are some exceptions to this (such as where the individual has provided explicit consent to the transfer, after being made aware of the risks), but most large-scale transfers rely on one of following methods of securing equivalent protections.