No one can tell the future, but at this time of year we can indulge in some crystal ball gazing!

Within the last 12 months or so, two recent privacy law developments have had tremendous implications for companies controlling, processing and transferring data between the UK, EU and elsewhere: (i) the European Court of Justice Schrems II decision, and (ii) of course, Brexit. Both have thrown new challenges and questions into the mix for companies transferring data across the Atlantic, and involved in cross-border investment activities.

Believe it or not, we have been enjoying a period of relative stability during 2020 – at least when it comes to Brexit. That is because we are still in the transition period, set to expire at midnight on 31 December, 2020.

Max Schrems has spoiled US plans for dealing with data from European countries for a second time. On 15^th July, the CJEU issued a judgment which invalidated the U.S. Privacy Shield. This had previously enabled data transfers between the U.S. and the EU without the need for any alternative transfer mechanisms. 

On the 16^th of  July, the Court of Justice of the European Union (“CJEU”) will release its opinion in the ‘Schrems II’ case, which could have a significant impact on the use of standard contractual clauses and third party transfers of personal data.