Since the CJEU's "Schrems II" judgment last year on the use of standard contractual clauses (SCCs), and some fairly challenging draft EDPB guidance applying that judgment, organisations have been working hard to find ways of keeping personal data flowing from the EU to third countries. Following the EDPB's guidance to the letter will require undertaking a detailed, and time consuming, legal evaluation and transfer risk assessment process. The requirement to put in place "supplementary measures" to protect data transferred under the SCCs is also likely to be burdensome and, in some cases, impractical.
In this context, there were some interesting comments last week from Prof. Dr. von Danwitz, the judge-rapporteur in the Schrems II case, about the possibility of relying on the derogations in Article 49 GDPR as an alternative to using SCCs. His view, given in a personal capacity at a conference, was that the scope of Article 49 remains untested by the CJEU, and therefore that organisations should consider this as an option, especially for intra-group data transfers.
For most organisations the main Article 49 derogations will be either: (i) that they have the data subject's explicit consent; or (ii) that the transfer is necessary for performance of a contract with the data subject. There are certainly hurdles to overcome for each (e.g. has the consent wording pointed out the risks of the transfer? is the consent freely given? is the transfer actually a core component of performing the contract?). Indeed, recent EDPB Guidance on Article 49 does suggest that EU regulators intend to interpret the derogations narrowly. However, these comments do perhaps show that a wider interpretation of Article 49 could have a more sympathetic ear at the CJEU than it does at the EDPB.
In light of this, before launching into the process of finalising new sets of SCCs, documenting risk assessments, and rolling out a range of technical, contractual and organisational "supplementary measures", it is certainly worth pausing and considering whether Article 49 could in fact be a suitable justification for any of your transfers.