Schrems II – effects of the judgment issued by CJEU (changed rules of personal data transfer to the US)
Last week, the Court of Justice of the European Union (the “CJEU”) invalidated the so called “Privacy Shield” being the legal basis for data transfer from the EU Member States to the US. Consequently, each entity which transfer personal data to the US (e.g. via tools used by its American counterparties) is obliged to search for another legal basis for this operation, based on the GDPR. The basis may take the form of Standard Contractual Clauses, i.e. an agreement to be concluded with the data importer in the US.