A team uses SCCs to send personal data to a jurisdiction known for extensive government surveillance but performs no analysis of local access laws or supplementary measures. Which Schrems II theme is being ignored?
Select an answer to reveal the explanation.
Short Explanation
Schrems II said contractual paperwork is not enough if foreign surveillance can walk through the walls. Ignoring local access laws while shipping data under SCCs is like locking the front door and leaving the back wide open. Assess the risk and add real supplementary measures when needed.
Full Explanation
Schrems II emphasised that SCCs’ validity in practice depends on whether the data subject’s essentially equivalent protection can be ensured, including against disproportionate government access. Exporters should examine third-country surveillance and redress frameworks and implement supplementary technical or organisational measures where SCCs alone are insufficient. The ruling is not limited to cookies, does not void SCCs everywhere automatically, and is not confined to anonymous data.