In 2013, a 25-year-old Austrian filed a lawsuit in an Irish court against a leading social media provider. The accusation was that the platform had forwarded his data to the parent company in the USA. The Irish court referred the case to the ECJ and the Austrian data protection activist named Maximilian Schrems got justice. The highest European court overturned the EU-US Privacy Shield and thus stopped the previous practice of transferring data to the USA. Data transfers to countries outside the EU are only permitted if a level of data protection comparable to the GDPR is guaranteed, the ECJ ruled. The EU Commission subsequently revised the standard contractual clauses for the transfer of personal data to third countries. Companies had until December 27, 2022 to adapt their contracts to the new clauses.
Not all companies are aware that they are transferring data to third countries because they are not always aware of where their service providers are storing and processing the data. But right now, the authorities are approaching the companies and asking. Those who are not yet using the new formulations should therefore hurry.
Leonie Schönhagen, attorney and manager at KPMG Law, and Dr. Daniel Taraz, attorney and senior manager at KPMG Law, talk in the podcast about what to do now, when to expect fines and in which cases exceptions apply.
The core topics of the podcast are:
All “KPMG Law on air” episodes can be found here.
© 2023 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit https://home.kpmg/governance.
KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.