International transfers of personal data

In its July 2020 Schrems II ruling, the Court of Justice of the European Union (CJEU) invalidated the European Commission's US adequacy decision on account of insufficient US data protection standards. Drawing from the judgment, personal data may – in principle – only be transferred to a third country outside the EU/European Economic Area if the third country ensures an 'essentially equivalent' level of data protection to that of the EU, or if supplementary measures are deployed to compensate for the lacunae in protection. With the United Kingdom (UK) becoming a third country within the meaning of EU data protection law, the convenient and cost-effective continuation of EU–UK data flows will depend on the adoption of the (already controversial) draft adequacy decisions concerning the UK. During its May plenary session, Parliament is due to debate resolutions on, respectively, the Schrems II ruling, and on UK data adequacy, i.e. the country's level of data protection.