THE PRIVACYPERFECT SOLUTION FOR SCHREMS II

As the Court of Justice of the European Union invalidated the EU-US Privacy Shield on the 16th of July 2020 in frame of the Schrems II case, it had immediate and far-reaching implications for organisations. Besides having to change how data transfers are managed (without a transition period), the ruling also meant that suddenly, transferring data to thousands of US organisations, including those offering the most used business tools, are now in violation of the GDPR.

The Court has also provided clarification on some extensive hurdles for using its most obvious alternative, Standard Contractual Clauses (SSCs). With 88% of organisations sharing data outside the EU relying on these approved model contracts to ensure safe processing, the weight the case puts on organisations became even heavier. Data exporters are now required to perform a case-by-case evaluation for equivalent data protection to that under EU law, as SCCs in themselves don’t provide such protection alone.