In the wake of Schrems II, the July 16, 2020, decision from the European Court of Justice that invalidated the EU-U.S. Privacy Shield as a legal means of data transfer between the European Union and the United States, businesses have been waiting for more concrete guidance from EU data protection authorities on what the state of play is with data transfers out of the European Union. With the abandonment of the Privacy Shield, it is already becoming clear that EU data protection authorities intend to actively enforce immediately.

This week, guidance finally emerged from one data protection authority in Germany. The data protection authority of Baden-Württemberg issued its own guidance on how companies should approach their data transfer analysis in a post-Schrems II world.

The following are a few key points from that guidance that businesses should consider as they revisit their data transfers:

• Now Is the Time to Revisit Your Transfers - Don't Wait for Some New Program: Schrems II invalidated the Privacy Shield as a legal mechanism for data transfer. Continued reliance on the Privacy Shield is a "no go": it was clearly signaled by this German data protection authority that it will not hesitate to enforce and fine companies that continue to solely rely on the Privacy Shield.
• Standard Contractual Clauses Are Not Sufficient on Their Own: If your business has been using standard contractual clauses in addition to the Privacy Shield, the German data protection authority made it clear that standard contractual clauses on their own do not provide a sufficient basis for legal data transfer. Using supports, such as encryption, is paramount to ensuring that individual data is protected during transfer.
• Check on Your Service Providers and Data Transfers. Are your service providers aware of the Schrems II decision? What is their legal basis for data transfer? Revisiting every data transfer with your service providers and ensuring they are still legally justifiable should be high on your priority list.
• Revisit Your Contracts. Businesses may want to revisit their standard contractual clauses and add supplemental clauses and changes.

While there may be a temptation to "wait and see" what happens in the wake of the invalidation of the Privacy Shield, as many businesses did after Schrems I invalidated the old Safe Harbor program in 2015, the guidance from the German data protection authority is likely the first in a wave of opinions and guidance to be issued by the EU data protection authorities. It's no longer 2015: the GDPR is in full effect, and the data protection authorities have been active in their monitoring of U.S. companies.