The European Data Protection Board has issued its much anticipated FAQs on what the Court of Justice of the European Union’s decision in Schrems II means for cross-border data transfers.
There is still no word on the “supplementary measures” that companies will need to implement on top of Standard Contract Clauses and Binding Corporate Rules for transfers to third countries without an adequate level of protection, such as the United States, but it contains some guidance on the framework of the discussion and how data exporters should start thinking about this issue.