SCCs and Supplementar y Measures-a bumpy road ahead for international data transfers

摘要

Since 16th July 2020, many data protection practitioners and organisations have been grappling with the fallout from the Schrems Ⅱ (Case C-311/18) decision. Of particular concern has been the dilemma left by the Court of Justice of the Europe-an Union (‘CJEU’) regarding the na-ture of the‘supplementary measures’ that can bolster existing guarantees in Standard Contractual Clauses (‘SCCs’) and make data transfers lawful. Compounding matters, this uncertainty comes in the midst of a global pandemic, where a growing number of people are working re-motely and are increasingly reliant on third party technology tools to enable business to operate as close to usual as possible. We now, however, have a better sense of what EU Supervisory Au-thorities expect due to the recent publications of the two recommenda-tions from the European Data Protec-tion Board (‘EDPB’), along with the draft decision and draft new SCCs from the European Commission (‘Commission’). This article draws some conclusions on practical measures for organisations to take, based on the new guidance.