The Court of Justice of the European Union (CJEU) delivered its judgement in “Schrems II” on July 16, 2020, invalidating one of the common methods for legally sharing personal data between entities in the EU / EEA and their affiliates or vendors in the US – the EU-US Privacy Shield program, in which more than 5300 US companies are enrolled -- and casting doubt on the future of the mechanism employed by most companies in the EEA to transfer data abroad, the EU-approved Standard Contract Clauses (“SCCs”).  Alternatives are available, but they are more limited and are also under pressure.

The EU General Data Protection Regulation (GDPR) controls how organizations collect, use and store personal data. It applies to both businesses based in the European Economic Area (EEA) and to those with no physical establishment in the EU, but with operations that fall into the extraterritorial scope of the GDPR.  Fines for GDPR violations can reach €20m or 4% of the annual worldwide turnover (whichever is higher).