Draft Guidance On Supplementary Measures For Cross-Border Personal Data Transfers

On November 10, 2020, the recently established Taskforce of the European Data Protection Board (EDPB), a body consisting of representatives of all the Data Protection Authorities (DPAs) in the European Economic Area (EEA), adopted two sets of Recommendations (one draft and the other finalised), both addressing the aftermath of the landmark Schrems II decision of the Court of Justice of the European Union (CJEU), which had scrutinised international personal data transfers under the General Data Protection Regulation (GDPR). Any international business should be aware of the significant impact that Schrems II has had on cross-border data transfers, as the judgment reinforced that protection granted to personal data of EEA individuals under the GDPR should travel with that data, even when the data leave the EEA. International businesses should therefore consider the key takeaways from both sets of Recommendations which we summarise below. Action will be