Schrems II Fallout Continued: Can Companies Rely On Consent?

The EDPB has provided input about consent in its recent FAQs responding to the Schrems II invalidation of Privacy Shield. As we wrote about previously in this series, Schrems II impacted how companies transfer data from the EU to the U.S.. As background, under GDPR, consent from the individual can be relied on to transfer information from the EU to an entity outside of the EU's borders if three conditions exist. The EDPB reminded companies of these three conditions in its FAQs, drawing on prior guidance about consent:

1. The consent is explicit.
2. The consent is specific to a specific data transfer or set of transfers.
3. The consent is informed, including informing the individual about the risks to their information if it is sent outside of the EU's borders.