A decision issued in March 2021 by the Bavarian Data Protection Authority is the first German enforcement action in connection with last year’s decision of the Court of Justice of the European Union on the validity of the European Commission’s Standard Contractual Clauses and the EU-US Privacy Shield. In the CJEU Decision, the court held that a transfer of personal data from the EU to third countries outside the European Economic Area under the EU Standard Contractual Clauses will be permissible under the GDPR if the level of protection of the transferred data is adequate. How do you assess whether your level of protection is adequate?
