EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
ble transfer mechanism (eg, adequacy or appropriate safeguards). 5.5 Recent Developments Recent developments at the EU level regarding the regulation of international transfers of personal data continue to be shaped by the aftermath of the judg - ment in Schrems II (C-311/18). The EU–US Data Pri - vacy Framework (DPF) was adopted on 10 July 2023, to restore a formal transatlantic data transfer mecha - nism by addressing privacy concerns related to US surveillance and redress options. Although debate persists as to whether the DPF fully achieves its intended level of protection, the General Court, in its judgment of 3 September 2025, Latombe v Commission (T-553/23), upheld the DPF, accept - ing that safeguards introduced by US Executive Order 14086 (7 October 2022) and the Data Protec - tion Review Court could ensure a level of protection essentially equivalent to that guaranteed by EU law. In May 2025, the Irish Data Protection Commission (DPC) imposed a substantial EUR530 million fine on TikTok Technology Limited (“TikTok”) for failing to ensure equivalent protection for personal data trans - ferred to China. The DPC found that, despite conduct - ing a transfer impact assessment (TIA), TikTok had not sufficiently assessed Chinese laws and practices affecting the data and therefore failed to demonstrate “essential equivalence” under the GDPR. This deci - sion raises doubts about the sufficiency of standard contractual clauses (SCCs) for transfers to certain third countries and highlights the practical challeng - es of compliance where risk assessments depend on third-country legal frameworks rather than solely on the physical location of data.
The CJEU and the EDPB have also provided important clarifications on international transfer rules, including the requirement to conduct transfer impact assess - ments to determine whether supplementary measures are needed in addition to SCCs (see EDPB Guidelines 05/2021 and Recommendations 01/2020; Schrems I (C-362/14); Schrems II (C-311/18); Ministerstvo zdravotnictví (C-710/23); and Bindl v Commission (T-354/22)). Together, this case law and regulatory guidance consolidate a framework that requires exporters to assess third-country laws carefully and implement effective supplementary safeguards where necessary. Looking ahead, proposed amendments under the Digital Omnibus Regulation include a more contextual definition of personal data, under which information would not qualify as personal data for a given entity if that entity cannot reasonably identify the data subject. This could potentially reduce the scope of GDPR obli - gations, including those related to international trans - fers, by excluding certain data from being classified as personal data. In practice, this may ease burdens on certain cross-border data routing arrangements by limiting the application of Chapter 5, GDPR. In EDPS v SRB (C-413/23 P), the CJEU confirmed that whether information constitutes personal data depends on the circumstances, particularly on who holds the additional information necessary for re-iden - tification and whether re-identification is reasonably likely in relation to a particular recipient. This confirms a contextual (or relational) understanding of personal data: information may constitute personal data in the hands of one actor, yet not for another recipient lack - ing reasonably available means of re-identification.
102 CHAMBERS.COM
Powered by FlippingBook