Direct answer · GDPR
Standard contractual clauses and Schrems II
No. Standard contractual clauses are an appropriate safeguard for transfers (Article 46(2)(c)), but the Court of Justice held in Schrems II that the exporter must verify, case by case, whether the law of the third country ensures a level of protection essentially equivalent to that guaranteed in the EU. If it does not, supplementary measures are needed, and otherwise the transfer must be suspended or ended. The EDPB describes that assessment and the supplementary measures in Recommendations 01/2020.
For you to establish
- To which country do the data go, and has the recipient excluded access by public authorities there?
Articles
- Art. 46(1) and (2)(c) GDPR Standard contractual clauses as an appropriate safeguard.
- Art. 44 GDPR The level of protection must not be undermined by a transfer.
Case law
- Schrems II (CJEU, C-311/18, ECLI:EU:C:2020:559, 2020-07-16)Operative part: case-by-case assessment, supplementary measures or suspension.
Guidelines and decisions
- Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (EDPB, v2.0, 2021-06-18)Recommendations on supplementary measures.
- Standard contractual clauses for transfers to third countries (European Commission, (EU) 2021/914, 2021-06-04)The standard contractual clauses of the Commission.
Read the article Check your own case General interpretation, not legal advice. The official source remains authoritative.
