The EU’s General Data Protection Regulation (GDPR) regulates the transfer of personal data in the European Union. For many multinational employers, Standard Contractual Clauses (SCCs) offer the only practical means of transferring this data to countries outside the EU or European Economic Area (EEA). In 2020, the Court of Justice of the European Union (ECJ) ruled, in a judgement known as “Schrems II,” that the SCCs may still be used for transferring EU personal data, but noted that supplemental measures would be needed to ensure a level of data protection in the third country equivalent to that in the EU. Following Schrems II, data protection authorities announced that they would carry out cross-border monitoring of international data transfers. The deadline for adapting SCCs to meet new compliance obligations is December 27, 2022. Therefore, internationally active group companies need to act now: Those that are not yet familiar with the Intra Group Data Transfer Agreement (IGDTA) should now take note; those that are already familiar with it should take stock.

In EU-based companies with subsidiaries (i.e., group companies), personal data of employees and applicants are often not only processed within the employing company, but also transferred to the parent company located abroad or to other group companies. There are many reasons for this: in the age of mobile working, employees in matrix structures report to superiors at another (foreign) company, the HR department is...

Read Full Story: https://www.littler.com/publication-press/publication/international-data-tran...