Personal Data Transfers outside the EU – the end of the Standard Contractual Clauses ?

The use of Standard Contractual Clauses (SCC’s) is an extremely common legal mechanism for transferring personal data outside the EU while staying on the right side of GDPR. Some may recall a preliminary reference made by the Irish High Court to the CJEU on foot of a challenge brought by Austrian privacy activist Max Schrems to Facebook’s use of SCCs to transfer data from Facebook Ireland to servers located in the United States. While the Advocate General’s opinion (published on 19 December 2019) supported the continued use of SCC’s, tomorrow CJEU as part of Schrems II Case will rule on the issue. The Advocate General’s opinion is followed in 90% of cases, but there is still a possibility the CJEU may take a different view. In theory this could mean the unravelling of many data processor/data controller contracts that rely on SCC’s as the basis for transferring data outside the EU.