Germany’s Datenschutzkonferenz (DSK) issues its guidance on Shrems II:
- The transfer of personal data to the United States based on Privacy Shield is not permitted and must be discontinued immediately
- Standard contractual clauses can continue to be used, but, depending on the result of the assessment of the data exporter, additional measures may be required. (This is different from the position expressed by the Berlin DPA).
- The DSK does not list the supplementary measures.
- The requirement for assessment / supplementary measures applies to BCRs as well.
- Transfers pursuant to Art. 49 derogations are permissible provided that the conditions of Art. 49 are met. The DSK refers readers to the European Data Protection Board guidance on this.
- The European Court of Justice did not provide any grace period on enforcement.
- The German supervisory authorities will coordinate their actions with their colleagues in the European Data Protection Board and will also advise on more specific issues in the future.
- The DSK supports the position of the European Data Protection Board as expressed in the FAQs recently published by it.
Read the full DSK guidance.
[View source.]
