YTYK You think you know

Card 14 of 18 International transfers ●●● Sharp edge

SCCs plus a look at the destination

Without adequacy, the usual tool is the standard contractual clauses — but since Schrems II they are not enough on their own: you must assess whether the destination's law lets the guarantees work, and add supplementary measures if it does not.

Why it is like this

A contract cannot bind a foreign intelligence service. The court's point was that the clauses are only as good as the legal environment they land in.

Not to be confused with

Paperwork. If the assessment concludes the clauses cannot be honoured and no supplementary measure fixes it, the correct outcome is to not transfer — the clauses do not authorise a transfer you have found to be unprotected.

In practice

Strong end-to-end encryption with keys retained in the EEA is the supplementary measure that most often works, because it removes the thing the foreign authority could compel.

Source: Court of Justice of the EU, Case C-311/18 (Schrems II), 16 July 2020 — Operative part, with Article 46(2)(c) of Regulation (EU) 2016/679. Read on .

Predict Check yourself

A transfer impact assessment concludes local surveillance law overrides the clauses, and no technical measure is workable. What does the exporter do?

  1. Suspend or do not start the transfer — SCCs do not authorise a transfer the assessment has shown to be unprotected.
  2. Proceed, since the SCCs are an approved Article 46 mechanism.
  3. Proceed and notify the supervisory authority within 72 hours.
  4. Proceed under the derogation for contractual necessity.
Show the answer

Suspend or do not start the transfer — SCCs do not authorise a transfer the assessment has shown to be unprotected.

This is the whole holding of Schrems II: the exporter bears the assessment, and a negative one is a stop, not a disclosure.