ANALYSIS: Where the Data Transfers Are, Post-Schrems II

“And now,” cried Max, “let the wild rumpus start!”

The famous line from Maurice Sendak’s “Where the Wild Things Are” seems appropriate in the wake of the latest ruling in Max Schrems’s ongoing privacy battle with Facebook.

The July 16 judgment from the Court of Justice of the European Union (CJEU) invalidated the EU-U.S. Privacy Shield, a popular mechanism for transferring personal data from the EU to the U.S., and imposed new obligations on those who transfer data from the EU via specific contractual language (known as standard contractual clauses, or SCCs).

With one transfer method invalidated and another encumbered ...