Podcast series “KPMG Law on air”: Data protection after Schrems II – Companies under pressure to act

In 2013, a 25-year-old Austrian filed a lawsuit in an Irish court against a leading social media provider. The accusation was that the platform had forwarded his data to the parent company in the USA. The Irish court referred the case to the ECJ and the Austrian data protection activist named Maximilian Schrems got justice. The highest European court overturned the EU-US Privacy Shield and thus stopped the previous practice of transferring data to the USA. Data transfers to countries outside the EU are only permitted if a level of data protection comparable to the GDPR is guaranteed, the ECJ ruled. The EU Commission subsequently revised the standard contractual clauses for the transfer of personal data to third countries. Companies had until December 27, 2022 to adapt their contracts to the new clauses.

The data protection authorities ask

Not all companies are aware that they are transferring data to third countries because they are not always aware of where their service providers are storing and processing the data. But right now, the authorities are approaching the companies and asking. Those who are not yet using the new formulations should therefore hurry.

Leonie Schönhagen, attorney and manager at KPMG Law, and Dr. Daniel Taraz, attorney and senior manager at KPMG Law, talk in the podcast about what to do now, when to expect fines and in which cases exceptions apply.

The core topics of the podcast are:

• From minute 1:48: What is behind “Schrems II”?
• From minute 3:33: Have the majority of companies already adopted the EU Commission’s new contract clauses and what were or are the challenges?
• From minute 5:23: What are the consequences of missing the transposition deadline?
• From minute 6:27: Why the authorities are asking questions now and what they want to know from companies.
• From minute 8:00: What is behind the abbreviation TIA?
• From minute 8:56: What can companies do if the data protection risks in a country are unmanageable?
• From minute 9:28: What should companies do now that have missed the implementation deadline?
• From minute 11:20: Not all third countries are created equal – countries with adequacy decision
• From minute 12:29: What is the impact of the U.S. “Executive Order”?

All “KPMG Law on air” episodes can be found here.