Data transfers outside the EU

International data transfers are likely to be held up to greater scrutiny. Not only is the CJEU considering the validity of the EC-approved standard contractual clauses in Schrems II (with the Advocate General opining that they are alright so long as data controllers and supervision authorities make sure that they are not simply paid lip service to), but the UKSC has ruled that a transfer for law enforcement purposes to the USA, in the context of a death penalty case, was unlawful because of a failure to follow the correct procedure. All of this is bound up with Brexit – the intention is for an adequacy decision on the UK to be in place by the end of this year, but it seems unlikely much progress is currently being made, and the UK’s position on data transfers is as yet unclear. With EU law imposing restrictions on freer transfer to the US and other countries as upheld in El Gizouli, there is an obvious tension between the UK’s desire to relax those restrictions and its need for an adequacy decision. The end of this year could be a major crunch point – especially if the CJEU also overturns standard contractual clauses or – also a possibility – strikes down the current US/EU Privacy Shield arrangement.

John Goss

---

Related barristers

John Goss

Call 2015