EDPB commits to role in post-Schrems II world

The European Data Protection Board (EDPB) says it intends to continue playing a constructive part in securing transatlantic transfer of personal data to benefit organisations and individuals in the European Economic Area (EEA).

The pledge came after the Court of Justice of the European Union (CJEU) invalidated the US-EU Privacy Shield agreement but said standard contractual clauses (SCCs) were an acceptable way of transferring across the Atlantic.

The CJEU ruled companies moving personal data from the EU to non-member, third countries will have to provide the same level of protection given by the European Union’s General Data Protection Regulation (GDPR).

The court was giving judgment on what has been dubbed Schrems II after a second lawsuit by Austrian privacy activist Max Schrems.

In a post-ruling statement, the EDPB said it “stands ready to provide the European Commission with assistance and guidance” to help it and the United States build a new framework in full compliance with EU data protection law.

On the question of SCCs covering trade, the EDPB highlighted the situation where an exporter assesses the importer’s country does not provide an essentially equivalent level of data protection, and so the exporter may have to consider putting in place additional measures to those included in the SCCs.

“The EDPB is looking further into what these additional measures could consist of,” the board said.

Looking ahead, it added: “The EDPB will assess the judgment in more detail and provide further clarification for stakeholders and guidance on the use of instruments for the transfer of personal data to third countries pursuant to the judgment.”


Registration now OPEN for PrivSec Global
Taking place across four days from 30 Nov to 3 Dec, PrivSec Global, will be the largest data protection, privacy and security event of 2020.

Reserve your place before 2nd October, and receive VIP access to PrivSec Global which includes priority access to limited space sessions, workshops, networking opportunities and exclusive content.

We have been awarded the number 1 GDPR Blog in 2019 by Feedspot.