The impact of Schrems II on data transfers
The Schrems II ruling by the Court of Justice of the EU invalidated the Privacy Shield as a mechanism for transferring data to the US and established additional requirements for Standard Contractual Clauses (SCC). Since then, companies must adopt a much more rigorous approach.
Current transfer mechanisms
1. Adequacy decisions
The European Commission recognizes that certain countries offer a level of protection equivalent to that of the GDPR. Currently includes: Andorra, Argentina, Canada (commercial sector), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, United Kingdom, and Uruguay.
For the US, the Data Privacy Framework (DPF) adopted in July 2023 allows transfers to self-certified companies.
2. Standard Contractual Clauses (SCC)
The SCCs updated by the European Commission in 2021 are the most widely used mechanism. They include four modules depending on the relationship between the parties:
- Module 1: Controller → Controller
- Module 2: Controller → Processor
- Module 3: Processor → Sub-processor
- Module 4: Processor → Controller
3. Binding Corporate Rules (BCR)
BCRs are internal policies approved by data protection authorities that allow intra-group transfers. They are costly to implement but ideal for multinational groups.
Transfer Impact Assessment (TIA)
After Schrems II, before transferring data based on SCCs, it is mandatory to conduct a TIA that assesses:
- Destination country legislation — Does it allow disproportionate government access to data?
- Surveillance practices — Are there mass surveillance programs?
- Effectiveness of SCCs — Are the clauses truly enforceable in that country?
- Supplementary measures — Are additional technical, organizational, or contractual measures necessary?
Recommended supplementary measures
- Encryption in transit and at rest with keys under the exclusive control of the exporter
- Pseudonymization before transfer
- Split processing — Divide processing so that no single processor has complete access
- Periodic audits of the data importer
At A2 Estudio Legal we help companies structure their international data transfers in a compliant manner. Consult with our team.