In Schrems II, the European Court of Justice rejected the
Privacy Shield as a legitimate basis for personal data transfers:
what are the potential consequences for data processing in the Gulf
Cooperation Council countries? This article provides
guidance.
The European Court of Justice's recent Schrems II decision
(case C-311/18) has attracted a lot of attention in data protection
circles. One of the key outcomes of the decision is that it removes
one of the grounds upon which European entities could legitimately
transfer personal data to certain entities in the United
States.
So, what relevance does a European court decision, relating to
Europe's General Data Protection Regulation and an
arrangement between the EU and the US Department of Commerce, have
on personal data processing operations in the GCC? That's a
very good question.
