What did the Court of Justice of the European Union recently decide regarding data transfers from the EU?
On July 16, 2020 the Court of Justice of the European Union (the Court) invalidated the EU-US Privacy Shield, which was one of the ways for companies to transfer data legally from the EU to the US. At the same time, the Court confirmed that Standard Contractual Clauses (SCCs) continue to provide a valid mechanism for companies to transfer personal data outside the EU.
However, we understand the Court stated that the suitability of data transfers under the SCCs may be challenged on a case-by-case basis, and that, in addition to the SCCs, supplementary measures may be necessary to ensure an adequate level of protection. The Court did not clarify what those supplementary measures might be.
Privacy and Security are among the highest priorities at Atlassian, and we’re closely following the recent Court decision about the EU-US Privacy Shield - and subsequent developments related to the Swiss-US Privacy Shield. We’re aware the European Data Protection Board recently issued further guidance on supplementary measures to meet the adequacy requirements of GDPR. We will continue to analyze these requirements and any others issued by European data protection authorities as they arise.