International Data Transfers: Adequacy, SCCs, BCRs & Schrems

International data transfers are among the hardest topics on the exam, and Domain three gives them real weight. The logic is in Article 44, the general principle: when you send personal data to a country outside the EU or the European Economic Area, a so-called third country, the level of protection guaranteed by the GDPR must not be undermined. In other words, the protection has to travel with the data.

You cannot do indirectly, by exporting data abroad, what the GDPR forbids you to do at home. Chapter V then sets out the permitted transfer mechanisms in a rough hierarchy, and you need to know all of them and the famous court cases that shaped them.

The cleanest mechanism is an adequacy decision under Article 45. The European Commission can decide that a third country, territory, or sector ensures an adequate level of data protection, essentially equivalent to the EU's. Once it does, data can flow to that country as freely as within the EU, with no extra safeguards needed.

The Commission has recognised a number of countries, including, for example, the United Kingdom, Switzerland, and Japan. For the United States, there is a partial route: the EU-US Data Privacy Framework, for which the Commission adopted an adequacy decision in July twenty twenty-three. It allows transfers to US organisations that self-certify to the framework.

Adequacy is the top of the hierarchy because it requires nothing extra from the exporter.

Where there is no adequacy decision, you turn to appropriate safeguards under Article 46. The most common are Standard Contractual Clauses, SCCs, pre-approved contract templates published by the Commission, the modernised set adopted in twenty twenty-one, which the data exporter and importer sign to commit the importer to GDPR-level protections. The other major Article 46 tool, detailed in Article 47, is Binding Corporate Rules, BCRs, internal data-protection rules approved by a supervisory authority that let a multinational group transfer data among its own entities worldwide.

BCRs are powerful but slow to get approved. Article 46 also recognises approved codes of conduct and certification mechanisms as safeguards. These mechanisms put the protection into a contract or binding internal rules rather than relying on the destination country's laws.

Now the cases that define this topic. Maximilian Schrems, an Austrian privacy activist, challenged transfers of his Facebook data to the US. In Schrems I, case C-362/14, decided in twenty fifteen, the Court of Justice invalidated the Safe Harbor framework, the then-current US adequacy arrangement, because US surveillance law gave authorities access to EU data without adequate protection or redress.

Safe Harbor was replaced by the Privacy Shield, but in Schrems II, case C-311/18, decided in twenty twenty, the court struck that down too, for the same fundamental reason. Importantly, Schrems II upheld Standard Contractual Clauses as valid in principle, but added a major condition that reshaped practice, which we cover next. The current EU-US Data Privacy Framework is the response to Schrems II, and it too may be challenged.

Schrems II's lasting effect is the transfer impact assessment, or TIA. Even when you use SCCs, you must assess whether the law and practice of the destination country would prevent the importer from honouring them, particularly because of government access to data. If protection falls short, you must add supplementary measures, such as strong encryption where you hold the keys, or stop the transfer.

The Body of Knowledge lists the TIA explicitly. Finally, when no adequacy decision and no Article 46 safeguard is available, Article 49 provides derogations for specific situations: the person's explicit consent to the transfer after being warned of the risks, transfers necessary to perform a contract, important reasons of public interest, or legal claims. But derogations are meant to be narrow, occasional, and non-repetitive, a last resort, not a routine basis for ongoing transfers.

The exam tests that they are exceptional.

So here is the transfers hierarchy. First, adequacy under Article 45, where the Commission has blessed the destination country, including the EU-US Data Privacy Framework for certified US firms since twenty twenty-three. Next, appropriate safeguards under Articles 46 and 47, mainly Standard Contractual Clauses and Binding Corporate Rules.

And last, the narrow Article 49 derogations. Schrems I struck down Safe Harbor in twenty fifteen, Schrems II struck down Privacy Shield in twenty twenty, and Schrems II also requires a transfer impact assessment and supplementary measures even when you use SCCs. That completes Domain three.

Go take the Domain three practice test before we move into scope and accountability.