Over the last few years, the challenges for organisations
transferring personal data outside of the EEA have become more
complicated, and the landmark decision of the CJEU in Schrems II
last summer has had significant implications for how data transfers
are undertaken. While the EU Commission is likely to sign off on
new model standard contractual clauses
("SCCs") in the next few months, we look
at how organisations might give greater consideration to the
derogations in Article 49, GDPR for certain transfers, and how
these derogations may become a more widely used mechanism for
transfers in the future.
Big Picture Issue
The CJEU's decision on data transfer mechanisms in
Schrems II has created a turbulent landscape for
organisations that transfer data outside of the EEA.
The key ruling in the Schrems II decision
was the immediate invalidation of the EU-US Privacy Shield (the
replacement for the Safe Harbour mechanism invalidated by the CJEU
in the earlier Schrems
