A team uses SCCs to send personal data to a jurisdiction known for extensive government surveillance but performs no analysis of local access laws or supplementary measures. Which Schrems II theme is being ignored?
Select an answer to reveal the explanation.
Short Explanation
Schrems II said contractual paperwork is not enough if foreign surveillance can walk through the walls. Ignoring local access laws while shipping data under SCCs is like locking the front door and leaving the back wide open. Assess the risk and add real supplementary measures when needed.
Full Explanation
Schrems II teaches that contractual safeguards may be insufficient where foreign surveillance or public-authority access rules undermine essentially equivalent protection. Exporters using SCCs toward jurisdictions with extensive government surveillance must assess those access risks and apply supplementary measures when needed. Ignoring that theme leaves residents’ and customers’ data exposed to structural risk that paperwork alone does not cure—whether the exporter is a city contractor or a private enterprise team.
SCCs are not automatically void in every country that has any national security statute; assessment is fact-specific. Supplementary measures are not limited to anonymous data—anonymous data fall outside GDPR, while personal data transfers are the point. Schrems II is not confined to website cookies; it reshaped enterprise transfer practice broadly.
Exam caveat: supplementary measures can be technical (encryption with keys outside the third country), contractual, or organisational; their effectiveness depends on whether they actually frustrate unlawful access.
Operational check: perform a surveillance/access-focused TIA, implement measures that match the threat model, document residual risk acceptance at the right level, and avoid “SCC signed = done” project gates.