Der Euro­päi­sche Daten­schutz­aus­schuss EDSA hat FAQ zum Schrems-II-Urteil des EuGH ver­öf­fent­licht. Viel Neu­es fin­det sich dar­in nicht. Der EDSA

  • betont, dass die wei­te­re Ver­wen­dung der Stan­dard­ver­trags­klau­seln nur zuläs­sig bzw. aus­rei­chend ist, wenn der Expor­teur zuvor sei­ne Haus­auf­ga­ben gemacht hat:

    Whe­ther or not you can trans­fer per­so­nal data on the basis of SCCs will depend on the result of your assess­ment, taking into account the cir­cum­stances of the trans­fers, and sup­ple­men­ta­ry mea­su­res you could put in place. The sup­ple­men­ta­ry mea­su­res along with SCCs, fol­lo­wing a case­by-case ana­ly­sis of the cir­cum­stances sur­roun­ding the trans­fer, would have to ensu­re that U.S. law does not impinge on the ade­qua­te level of pro­tec­tion they gua­ran­tee. If you come to the con­clu­si­on that, taking into account the cir­cum­stances of the trans­fer and pos­si­ble sup­ple­men­ta­ry mea­su­res, appro­pria­te safe­guards would not be ensu­red, you are requi­red to sus­pend or end the trans­fer of per­so­nal data. Howe­ver, if you are inten­ding to keep trans­fer­ring data despi­te this con­clu­si­on, you must noti­fy your com­pe­tent SA.

  • gibt (weni­ge) Hin­wei­se zu den Aus­nah­me­grün­den nach Art. 49 DSGVO (z.B. aus­drück­li­che Einwilligung);
  • hält fest, dass er der­zeit mög­li­che Zusatz­be­stim­mun­gen zu SCC ana­ly­isiert:

    The EDPB is curr­ent­ly ana­ly­sing the Court’s judgment to deter­mi­ne the kind of sup­ple­men­ta­ry mea­su­res that could be pro­vi­ded in addi­ti­on to SCCs or BCRs, whe­ther legal, tech­ni­cal or orga­ni­sa­tio­nal mea­su­res, to trans­fer data to third count­ries whe­re SCCs or BCRs will not pro­vi­de the suf­fi­ci­ent level of gua­ran­tees on their own.