European Data Protection Board Publishes Recommendations on Measures to Supplement Data Transfers in Light of the Schrems II Decision

During its 41st plenary session, the European Data Protection Board adopted Recommendations on measures to supplement data transfer tools to ensure compliance with the EU level of protection of personal data.

The Recommendations were adopted as a follow-up to the CJEU’s Schrems II ruling which requires controllers relying on the Standard Contractual Clauses (SCCs) and similar data transfer mechanisms to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data in the third country, if the law of the third country ensures a level of protection of the personal data transferred that is essentially equivalent to that guaranteed in the European Economic Area.

The Recommendations allow data exporters to add technical, contractual, and organizational measures that are supplementary to the SCCs to ensure effective compliance with that level of protection where the safeguards contained in SCCs are not sufficient.  Some notable technical measures include encryption, transfer of pseudonymised data, and split data processing. The applicability of these and other measures depends on the particular circumstances of the transfers. The Recommendations provide various data transfer scenarios for which effective measures could be found, as well as scenarios where supplemental measures would not be adequate.

In addition, on November 12, 2020, the European Commission published a draft implementing decision on the Standard Contractual Clauses and draft set of new SCCs.

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653