Article · Intellectual Property and Technology

Moving Personal Data Out of the EU After Schrems II: SCCs and Transfer Impact Assessments

Type
Article
Jurisdiction
National
Date
2025-03-08
Topic
Intellectual Property and Technology

Since Schrems II, moving personal data out of the European Economic Area is no longer a signing exercise but a research task. This article maps the mechanisms that survived and the duty that reshaped all of them: the EU-U.S. Data Privacy Framework and the Latombe challenge testing it, the 2021 modular Standard Contractual Clauses, the mandatory Transfer Impact Assessment and the six-step EDPB methodology behind it, the three families of supplementary measures and the scenarios none of them can rescue, Binding Corporate Rules, the wider Article 46 safeguards menu, and the narrow Article 49 derogations. It works through how the rules bite differently for cloud, AI, distributed teams, and ad tech, tracks the parallel UK regime, and reviews an enforcement record already measured in ten figures. The organizing claim is simple: Chapter V now demands genuine legal analysis of destination-country law, and some transfers will not survive that analysis honestly conducted.

Moving Personal Data Out of the EU After Schrems II: SCCs and Transfer Impact Assessments

Intellectual Property and Technology > Privacy and Data Security | Published 8 March 2025 - Updated 4 April 2025 | UpLaw - uplaw.us

Abstract. In Schrems II (Case C-311/18, 16 July 2020) the Court of Justice of the European Union struck down the EU-U.S. Privacy Shield and held that anyone relying on Standard Contractual Clauses must independently verify that the destination country's law will not stop the data importer from honoring its contractual promises. That holding converted transfer compliance from paperwork into substantive legal analysis. This article explains the architecture that grew up around it: the EU-U.S. Data Privacy Framework and the annulment action now testing it, the 2021 modular SCCs and the mandatory Transfer Impact Assessment, the three families of supplementary measures and the scenarios where each one fails, Binding Corporate Rules and the fuller Article 46 safeguards menu, the deliberately narrow Article 49 derogations, and the parallel United Kingdom regime. Enforcement penalties already run into ten figures, so the working message is blunt: treat these requirements as real legal constraints, because some transfers cannot be rescued by any clause.

The full text of this document is available to Executive subscribers and above. See plans.