Data transfers after Schrems II - the response of authorities

Out-Law Guide | 06 Jan 2021 | 11:10 am | 18 min. read

The ruling by the Court of Justice of the EU (CJEU) on 16 July 2020 in the so-called 'Schrems II' case has significant implications for the transfer of personal data outside of the European Economic Area (EEA).

The CJEU confirmed, in principle, that businesses can use European Commission-endorsed standard contractual clauses (SCCs) to underpin data transfer arrangements to jurisdictions outside of the EEA. However, its judgment emphasised the need for due diligence by businesses if they wish to use SCCs, and called into question whether businesses can use SCCs to facilitate data transfers to certain jurisdictions in a way which complies with the EU's General Data Protection Regulation (GDPR).

The court further confirmed that businesses that have relied on the EU-US Privacy Shield for transferring personal data from the EEA to the US can no longer do so.

As businesses seek to understand their options, it is important they recognise that the picture continues to evolve. Authorities across Europe and beyond have given their response to the CJEU's ruling, with fresh guidance and proposed new transfer tools issued.

We have compiled a directory of the related statements and guidance issued by EU institutions, national data protection authorities and other relevant regulatory bodies following the Schrems II judgment, which will be updated as further announcements are made. 

EU institutions

EU institution Type of announcement Date issued (2020 unless stated otherwise)
European Data Protection Board

Statement

 

FAQs

 

Recommendations on the European Essential Guarantees for surveillance measures

 

Recommendations on measures that supplement transfer tools

 

Press release

 

Press release - two new sets of SCCs

17 July

 

24 July

 

10 November

 

 

11 November

 

11 November

 

20 November

European Data Protection Supervisor

Statement

 

Strategy for EU institutions to comply

16 July 

 

29 October

European Commission

Opening remarks

 

Consultation - standard contractual clauses for transferring personal data to non-EU countries (implementing act)

 

News - SCCs

16 July

 

12 November

 

13 November

European Parliament  Research paper  15 September 

EU: national data protection authorities

Country Type of announcement Date (2020 unless otherwise stated)
Austria    
Belgium Statement  31 August 
Bulgaria  News  16 July 
Croatia Statement  20 July
Cyprus  News 5 August 
Czech Republic 

News

 

Impact Statement

16 July

 

7 August

Denmark 

Press release 

 

Q&A

 

News

17 July

 

10 August

 

11 November

Estonia 

News

 

News

17 July

 

11 November

Finland

News

 

News

 

News

 

News

22 July 

 

8 September

 

17 November

 

2 December

France

News 

 

FAQ

17 July 

 

31 July

Germany

BfDI press release 

 

DSK press release

16 July

 

28 July

Greece Statement 30 September 
Hungary    
Ireland Statement  16 July 
Italy Statement  29 July 
Latvia

Press release

 

Notice

 

News

20 July

 

8 August

 

17 November

Lithuania News  20 July 
Luxembourg

News

 

News

27 July

 

17 November

Malta News 17 November 
Netherlands

News

 

News 

20 July

 

11 November

Poland

News

 

News

 

News

 

News

 

News 

20 July

 

13 November

 

17 November

 

23 November

 

24 November

Portugal    
Romania Press release  20 July 
Slovakia News
16 July 
Slovenia

News

 

News 

16 July

 

16 November

Spain News  9 October 
Sweden

News

 

Guidelines

17 July

 

7 September

Non-EU / EEA authorities

Country  Type of announcement  Date (2020 unless otherwise stated)
Liechtenstein 

News

 

Update

17 July

 

3 December

Norway 

News

 

Q&A

 

News

 

News 

16 July

 

27 July

 

9 September

 

11 November

Iceland  News  16 July  
Switzerland  News  16 July  
UK 

ICO statement

 

UK government statement

16 July

 

17 July 

US 

Department of Commerce statement

 

Senate Committee on Commerce press release

 

Department of Commerce - Press release

 

Letter from Deputy Assistant Secretary James Sullivan on the Schrems II decision

 

Remarks by Commerce Secretary Wilbur L. Ross at the U.S.-Ireland Economic Forum

16 July

 

17 July

 

10 August

 

-

 

22 October

German state and regional data protection authorities

State or region Type of announcement  Date (2020 unless otherwise stated)
Baden-Württemberg 

Press release

 

News

 

Guidelines

 

Podcast

24 August

 

1 September

 

7 September

 

15 October

Bayern 

News

 

Guidance 

29 July

 

2 October 

Berlin  Press release  17 July 
Brandenburg     
Bremen    
Hamburg Press release  16 July 
Hessen  News  28 July 
Mecklemburg-Vorpommern 

News

 

News

23 July

 

28 July

Niedersachsen 

FAQ

 

Guidance 

21 August

 

November

Nordrhein-Westfalen 

News

 

News

 

Recommendations

22 July

 

July

 

-

Rheinland-Pfalz 

Press release

 

FAQ

 

Statement

 

Guidance

 

News

16 July

 

16 July

 

24 July

 

18 August

 

10 November

Saarland  News  29 July 
Sachsen     
Sachsen-Anhalt     
Schleswig-Holstein     
Thüringen 

Press release

 

News

16 July 

 

11 November