ARTICLE · 18 NOVEMBER 2020

A Methodology For Conducting Data Transfers In A Post Schrems II World

Cooley LLP

Explore more from Cooley LLP

On November 10, 2020, the European Data Protection Board issued two new pieces of guidance.

United StatesPrivacy

Leo Spicer-Phelps

Patrick Van Eecke

Author LinkedIn connections

On November 10, 2020, the European Data Protection Board issued two new pieces of guidance. Read together, they outline a detailed methodology to follow when conducting data transfers under the EU General Data Protection Regulation - such guidance has been keenly anticipated following the Court of Justice for the European Union's ruling in the case commonly known as Schrems II.

The two pieces of guidance are:

New "recommendations on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data"
Updated "recommendations on the European Essential Guarantees for surveillance measures"

How can Cooley help you apply this methodology to your operations?

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Related Articles

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

United StatesPrivacy

McDermott Will & Schulte

Colorado’s Interim Draft ADMT Rules: What Businesses Need To Know Now

United StatesPrivacy

Moore & Van Allen, PLLC

Most Privacy Programs Plan For Vendors, Deals, And Incidents. Few Plan For What Happens To Company Data If The Business Fails.

United StatesPrivacy

Lowenstein Sandler LLP

Governor Newsom Signs SB 690: California Eliminates Private Right Of Action For Website Pen Register And Trap And Trace Claims Under CIPA

United StatesPrivacy

Benesch, Friedlander, Coplan & Aronoff LLP

California Finalizes Next Wave Of State AI And Privacy Regulation

United StatesPrivacy

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Privacy
- Data Protection

Related Comparative Guides

Comparative Guide

Data Protection & Cybersecurity

See more popular content from

Privacy

Did UPMC Data Breach Ruling Lock Plaintiffs Out Of State Court?

Scott L. Vernick was quoted in The Legal Intelligencer article, "Did UPMC Data Breach Ruling Lock Plaintiffs Out of State Court?" on January 23, 2017.

United StatesPrivacy

Fox Rothschild LLP

California Enacts First-of-Its-Kind Legislation Governing Lawyer AI Use

California Governor Newsom has signed Senate Bill 574 into law, establishing the nation's first statutory framework governing how attorneys and arbitrators use generative AI in their professional practice. The legislation creates specific obligations around confidentiality protection, accuracy verification, and disclosure requirements that take effect January 1, 2027.

United StatesPrivacy

Seyfarth Shaw LLP

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.

United StatesPrivacy

Wilson Elser Moskowitz Edelman & Dicker LLP

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

United StatesPrivacy

Kelley Drye & Warren LLP

New Laws Target Youth-Facing AI And Online Services

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

United StatesPrivacy

Taft, Stettinius & Hollister LLP

META Settles Multi-state Child Safety And Privacy Litigation

Meta Platforms has agreed to pay $17 billion over ten years to resolve multistate litigation alleging the company engineered Facebook and Instagram to addict minors while concealing the risks. Beyond the historic financial penalty, the settlement mandates sweeping platform changes including default usage limits, overnight lockouts, and parental controls for users under eighteen.

United StatesPrivacy

Troutman Amin LLP

Emerging Enforcement Trends In Digital Health Data Privacy: Lessons From Washington’s My Health My Data, FTC vs. Hims & Hers And UCHealth Enforcement Actions

Federal and state regulators are intensifying scrutiny of healthcare and digital health companies over tracking technologies that share sensitive patient data with advertising platforms. Recent enforcement actions against major telehealth providers and healthcare systems reveal how common marketing practices can trigger significant legal liability under privacy laws, even for organizations not covered by HIPAA.

United StatesPrivacy

Benesch, Friedlander, Coplan & Aronoff LLP

Federal Trade Commission Provides New Guidance On Its Health Breach Notification Rule For Health Apps And Connected Devices

On September 15, the Federal Trade Commission ("FTC") issued a policy statement ("Statement") addressing the scope of its Health Breach Notification Rule ("Rule") on health apps and connected devices.

United StatesPrivacy

The Data Breach Brief: Week Of September 30th, 2026

Multiple organizations have recently disclosed significant data breaches affecting thousands of individuals, with compromised information ranging from basic contact details to highly sensitive medical records and financial data. The incidents span various sectors including healthcare, insurance, and professional services, raising questions about the scope of exposure and potential remedies for affected individuals.

United StatesPrivacy

Morgan & Morgan

California Legislation: End-Of-Session Check-In

California's legislature has sent a comprehensive package of privacy, AI, and advertising bills to Governor Newsom's desk, with decisions due by September 30, 2026. The legislation addresses sensitive personal information protections, data broker obligations, AI-powered chatbot regulations, and digital replica rights, potentially reshaping how businesses handle consumer data and automated decision-making systems. Will these bills become law and set new national standards for technology regulation?

United StatesPrivacy

Frankfurt Kurnit Klein & Selz PC