The invalidation of Privacy Shield created significant uncertainty for transatlantic data flows. Here is what organisations need to know about lawful international transfers.
The Schrems II Decision
In July 2020, the Court of Justice of the European Union (CJEU) issued its landmark ruling in Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (Schrems II), invalidating the EU-US Privacy Shield framework and casting doubt on the use of Standard Contractual Clauses (SCCs) for transfers to the United States.
The Current Framework
Following Schrems II, organisations transferring personal data outside the European Economic Area (EEA) must rely on one of the transfer mechanisms set out in Chapter V of the GDPR:
- **Adequacy decisions**: The European Commission has recognised a number of countries as providing an adequate level of data protection, including the UK (for transfers from the EU), Switzerland, Japan, and South Korea.
- **Standard Contractual Clauses**: The European Commission issued updated SCCs in June 2021. These remain the most widely used transfer mechanism, but must be supplemented by a Transfer Impact Assessment (TIA).
- **Binding Corporate Rules**: Suitable for intra-group transfers within multinational organisations.
- **Derogations**: For specific situations, including explicit consent and contractual necessity.
The EU-US Data Privacy Framework
In July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (DPF), providing a new mechanism for transatlantic transfers. However, legal challenges are anticipated, and organisations should maintain SCCs as a fallback.
What Organisations Should Do
Review all third-country transfers, document the legal basis for each, conduct Transfer Impact Assessments where required, and ensure your SCCs are updated to the 2021 versions. A structured review of transfer arrangements can help identify the measures your organisation may need.