Using the new EU standard clauses to enable cross-border data export

From 27 June 2021, organisations will be able to adopt new ‘standard contractual clauses’ (SCCs) to permit lawful export of personal data from the EU to ‘third countries’. This post: recommends what companies should do now describes the background to the EU’s data export rules explains how the new SCCs differ from prior versions What …

Read more

Data export: EU provides more clarity after Schrems II

In documents published last week, the EU provided some welcome clarity on how organisations should address the invalidation of Privacy Shield as a basis for exporting personal data from the EU. On 10 November 2020, the European Data Protection Board (EDPB) adopted recommendations on ‘supplemental measures’, which can be considered to ensure compliance with the …

Read more

EDPB guidance on ‘supplemental measures’ for data export

On 10 November, the European Data Protection Board adopted a recommendation on supplemental measures which might be used to ensure compliance with the EU level of protection of personal data when exported to third countries with an insufficient level of protection. The recommendation both sets out a process to be followed by data exporters and, …

Read more

Exporting data from the EU after Schrems II: what to do now

As previously discussed, the European Court of Justice’s recent Schrems II decision both (i) invalidated the US privacy shield; and (ii) threw into question alternative justifications for the export of personal data from the EU to the US. Whilst there is yet to be a substantive response from the European Commission, initial reactions from the …

Read more

European Court invalidates US Privacy Shield and questions blanket use of Standard Contractual Clauses

Schrems II disrupts data export from EU: on 16 July 2020, the European Court of Justice decided, overturning the 2016 Privacy Shield Decision of the European Commission, that the US Privacy Shield did not, and does not, provide an adequate level of protection for the transfer of personal data from the EU to the US.