No transitional period on SCC/BCR decision, DPAs say

The EU DPAs say that while Standard Contractual Clauses (SCCs) can, as a rule, still be used to transfer data to a third country, the threshold set by the Court of Justice of the European Union (CJEU) for transfers to the US applies for any third country. The same goes for Binding Corporate Rules (BCRs), the DPAs say in FAQs, published on 23 July by the European Data Protection Board (EDPB).

‘The EDPB is currently analysing the Court’s judgment to determine the kind of supplementary measures that could be provided in addition to SCCs or BCRs, whether legal, technical or organisational measures, to transfer data to third countries where SCCs or BCRs will not provide the sufficient level of guarantees on their own. The EDPB is looking further into what these supplementary measures could consist of and will provide more guidance.’

The DPAs say that there is no transitional period - any transfer to the US needs to be re-assessed for their legal basis. Transfers relying on the EU-US Privacy Shield are now illegal. ‘Should you wish to keep on transferring data to the US, you would need to check whether you can do so under the conditions laid down, the DPAs state.

The DPAs suggest that data controllers contact their data importers to verify the level of data protection legislation of each country to which they transfer personal data, and conduct an assessment.

See EDPB - FAQS on the judgment of the CJEU in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems

Read more about this decision in the August 2020 edition of PL&B International Report.