The Court of Justice of the European Union (CJEU) delivered its judgement in “Schrems II” on July 16, 2020, invalidating one of the common methods for legally sharing personal data between entities in the EU / EEA and their affiliates or vendors in the US – the EU-US Privacy Shield program, in which more than 5300 US companies are enrolled -- and casting doubt on the future of the mechanism employed by most companies in the EEA to transfer data abroad, the EU-approved Standard Contract Clauses (“SCCs”).  Alternatives are available, but they are more limited and are also under pressure.

The EU General Data Protection Regulation (GDPR) controls how organizations collect, use and store personal data. It applies to both businesses based in the European Economic Area (EEA) and to those with no physical establishment in the EU, but with operations that fall into the extraterritorial scope of the GDPR.  Fines for GDPR violations can reach €20m or 4% of the annual worldwide turnover (whichever is higher).

The European Union has emerged as an undeniable leader in the comprehensive regulation of the digital sphere. Its approach towards privacy, dominant tech platforms, online content moderation, and the development of artificial intelligence has the potential to influence regulatory trends across the globe. From small businesses to multinational corporations, any entity operating within the EU market or interacting with EU citizens faces a rapidly evolving set of complex requirements.