A decision issued in March 2021 by the Bavarian Data Protection Authority is the first German enforcement action in connection with last year’s decision on the validity of the European Commission’s Standard Contractual Clauses and the EU-US Privacy Shield. In the CJEU Decision, the court held that a transfer of personal data from the EU to third countries under the EU Standard Contractual Clauses will be permissible under the GDPR, only if the level of protection of the transferred data is adequate. Companies whose processing activities are subject to the GDPR should map their international personal data transfers and, where required, explore legally and alternatives to transfers.
