In July 2020, the Court of Justice of the European Union invalidated the Privacy Shield, one of the main instruments for lawful transfer of personal data to the US, and introduced new conditions for transfers made outside the EU under the Standard Contractual Clauses. This is the Schrems II case which has affected all non-EU data importers, including service providers that receive personal data from the EU. If, in the course of your business, you transfer personal data you have received from EU/UK individuals to a non-EU/UK entity, such as a cloud service provider, you have to adopt a new level of diligence on data protection for each provider.

Our market-leading Privacy and Cybersecurity team has prepared the following Schrems II Source Kit which includes insights from the consultation submissions made by various organisations relating to the EDPB Guidance on Schrems II and the proposed new SCCs, and links to the key source materials.

Access the Source Kit here to read our detailed thoughts on this.