SCHREMS II FALLOUT CONTINUES: NEW SCCS AND EDPB GUIDANCE COMING SOON

On 3 September 2020, members of the European Parliament together with Max Schrems, the Commissioner for Justice and the Chairwoman of the European Data Protection Board (“EDPB”) met to discuss the future of EU-US data transfers in light of European Court of Justice’s (“ECJ”) decision in Schrems II.

The Commissioner confirmed that the European Commission are working on a revised set of Standard Contractual Clauses, which we assume will address some of the concerns coming out of the Schrems II judgement, as well as generally updating the SCCs to reflect the GDPR rather than the old Directive.  In addition, the Commissioner confirmed that the Commission is also working with their US counterparts in order to develop a new, and we assume stronger, framework to replace Privacy Shield.  However, it remains to be seen whether it is in fact possible to balance the ECJ’s concerns, as expressed in Schrems II, with the US legal system in order to create such a framework.  Max Schrems has already stated that unless such a framework complies in every way with the ECJ’s decision, that there will be a Schrems III.

Finally, the Chairwoman of the EDPB confirmed that the EDPB is preparing guidance and recommendations to assist exporting controllers and processors to identify and implement appropriate additional measures when using the Standard Contractual Clauses or Binding Corporate Rules to export personal data to a third country whose legal system does not adequately protect personal data.  This guidance will be welcome as there has yet to be any harmonised or consistent guidance drafted or adopted by supervisory authorities across the EU.

Whilst these confirmations are not unexpected, it is reassuring to see that these steps are being taken, and we would hope to see further updates from both the Commission and the EDPB in this respect in the coming weeks.