Der Europäische Datenschutzausschuss EDSA hat FAQ zum Schrems-II-Urteil des EuGH veröffentlicht. Viel Neues findet sich darin nicht. Der EDSA
- betont, dass die weitere Verwendung der Standardvertragsklauseln nur zulässig bzw. ausreichend ist, wenn der Exporteur zuvor seine Hausaufgaben gemacht hat:
Whether or not you can transfer personal data on the basis of SCCs will depend on the result of your assessment, taking into account the circumstances of the transfers, and supplementary measures you could put in place. The supplementary measures along with SCCs, following a caseby-case analysis of the circumstances surrounding the transfer, would have to ensure that U.S. law does not impinge on the adequate level of protection they guarantee. If you come to the conclusion that, taking into account the circumstances of the transfer and possible supplementary measures, appropriate safeguards would not be ensured, you are required to suspend or end the transfer of personal data. However, if you are intending to keep transferring data despite this conclusion, you must notify your competent SA.
- gibt (wenige) Hinweise zu den Ausnahmegründen nach Art. 49 DSGVO (z.B. ausdrückliche Einwilligung);
- hält fest, dass er derzeit mögliche Zusatzbestimmungen zu SCC analyisiert:
The EDPB is currently analysing the Court’s judgment to determine the kind of supplementary measures that could be provided in addition to SCCs or BCRs, whether legal, technical or organisational measures, to transfer data to third countries where SCCs or BCRs will not provide the sufficient level of guarantees on their own.