On July 16th, the CJEU issued the Schrems II judgment which invalidates the Privacy Shield Decision and provides clarifications on SCCs.

A lot of noise and “fog” amongst organizations, particularly on the effects of the Schrems II judgement. This means that EU organizations should not be able anymore to rely on EU-U.S. Privacy Shield for transferring data to U.S.-based organizations.

It is, however, expected for the EU supervisory authorities and EDPB to react soon and to shed more light on this issue for the organizations.

Relevant highlights:

• What does it mean that the EU-U.S. Privacy Shield was invalidated?
• What about the ongoing transfers under the EU-U.S. Privacy Shield?
• Is there any grace period for becoming compliant as regards ongoing transfers under the EU-U.S. Privacy Shield?
• Are standard contractual clauses (SCCs) still valid?
• What should organizations expect for future?
• What should organizations do next?

To read the entire legal bulletin, please download the .pdf attached or visit http://www.tuca.ro/legal_bulletin/