EDPB Sheds Post-Schrems II Light On Supplementary Measures For Data Transfers

The EDPB recently published recommendations on additional security steps to take when transferring personal data out of the EU. As outlined in our previous series of posts, the EU found this summer that the EU-US Privacy Shield was an invalid mechanism for transferring personal information from the EU to the US. As an alternative for companies wishing to transfer personal information to the US from the EU, the EU pointed to standard contractual clauses. At the time, though, they caveated that controllers relying on the SCCs may have to use supplementary measures to protect outbound personal data. There was confusion, however, around what such additional measures should be. In this recent guidance, the EDPB recommends that companies exporting data out of the EU in reliance on SCCs take six steps. These are useful for review by exporting companies in the EU, as well as entities in the US. The latter can expect to be asked questions by their EU counterparties that relate