Privacy & Information Security Law Blog

On July 28, 2020, German supervisory authorities (Datenschutzkonferenz, the “DSK”) issued a statement reiterating the requirement for additional safeguards when organizations rely on Standard Contractual Clauses (“SCCs”) or Binding Corporate Rules (“BCRs”) for the transfer of personal data to third countries in the wake of the Court of Justice of the European Union’s (the “CJEU”) invalidation of the Privacy Shield Framework. In its July 16, 2020 judgment, the CJEU concluded that SCCs issued by the European Commission for the transfer of personal data to data processors established outside of the EU are valid, subject to the need to assess whether additional safeguards are required depending on the recipient jurisdiction. In this same decision, the CJEU struck down the EU-U.S. Privacy Shield Framework.

In its statement, the DSK highlighted the need, following the CJEU’s judgment, to ensure that organizations receiving EU personal data outside of the European Economic Area on the basis of SCCs are able to provide a level of protection that is “essentially equivalent” to that of the EU, and able to prevent the law of the recipient country from interfering with any additional protective measures put in place to the extent that such interference would impair the effectiveness of those measures. The DSK specified that SCCs without additional measures are generally not sufficient for data transfers to the U.S. This same standard was highlighted with respect to BCRs, another transfer mechanism provided by the EU General Data Protection Regulation (“GDPR”), which multi-national organizations may turn to following the Privacy Shield’s invalidation.

No guidance has yet been provided as to what additional measures organizations could rely on to suitably enhance the level of protection for personal data. The DSK also emphasized that the CJEU did not provide for any transition or grace period and suggested that data controllers promptly verify the conditions under which they can continue transferring personal data to the U.S.

Austrian privacy activist Max Schrems—the man responsible for the repeated challenges to EU-U.S. transfer mechanisms—has stated his intent to further challenge Facebook’s data transfers in the wake of the CJEU’s judgment. In a letter to the Irish Data Protection Authority (the “DPC”) obtained by POLITICO, a lawyer for Mr. Schrems set a July 31 deadline for the DPC to clarify the legal basis relied on by Facebook for its EU-U.S. data transfers. The letter states that Mr. Schrems intends to make submissions by August 14, 2020 with regard to any new legal basis relied on. In addition, the letter argues that the appropriate legal basis should be detailed within Facebook’s data processing inventory as required under Article 30 of the GDPR, and that this information should be made public as part of Facebook’s privacy notices as required by Articles 13 and 14 of the GDPR. The letter requests that the DPC issue a final decision on the matter of Facebook’s data transfers to the U.S. by October 1, 2020.