Schrems II: The EDPB Released a FAQ Awaiting its Guidance on the CJEU Judgment

Schrems II: The EDPB Released a FAQ Awaiting its Guidance on the CJEU Judgment

On 23 July 2020, the European Data Protection Board (EDPB) released a FAQ on the consequences of the CJEU’s judgement of 16 Juley 2020 (Schrems 2)

This judgment invalidates the Privacy Shield, an EU-US data transfer mechanisms, and conditions the validity of the Standards contractual clauses (SCCs), another transfer mechanisms, to the prior analysis of the level of protection provided by the third country recipient and the implementation of additional measures where necessary.

This FAQ  provides a glimpse of the position of the Authorities following the CJEU Decision that calls into question the possibility to transfer any personal data to the US. However, the EDPB remains relatively unspecific as it is currently working on more detailed guidance that should be released shortly.

CJEU: The Judgement on the Validity of the Standard Contractual Clauses Expected on July 16, 2020

CJEU: The Judgement on the Validity of the Standard Contractual Clauses Expected on July 16, 2020

The Court of Justice of the European Union (“CJEU”) announced that it will deliver its judgement in the Schrems II case (case C-311/18) on July 16, 2020.

This judgement will determine whether the Standard Contractual Clauses (“SCCs”) are a valid personal data transfer mechanism under the General Data Protection Regulation (“GDPR”).

This mechanism being widely used by companies to transfer personal data outside of the EU, the decision is eagerly awaited.

EDPB: Danish Standard Contractual Clauses Published in the Register for Decisions

EDPB: Danish Standard Contractual Clauses Published in the Register for Decisions

The final version of the standard contractual clauses (SCCs) for contracts between controller and processor submitted by the Danish Supervisory Authority has been published in the European Data Protection Board (EDPB) Register for Decisions.

They have been adopted by the Danish Supervisory Authority under article 28(8) GDPR allowing the Supervisory Authority to adopt standard processor agreements.