Norway’s Datatilsynet issues detailed FAQ’s on #SchremsII:
Notable takeaways:
“[T]he additional measures…could potentially be…legal, technical or organizational measures. At present…there is great uncertainty about what kind of additional measures may be sufficient if the third country has laws that take precedence over…or otherwise lower the level of protection. This means that at present it is very challenging to transfer personal data to such third countries, and in practice it will probably not be possible for most people to do so. EDPB is working to investigate what ‘further measures’ may entail.”
“Many may have difficulty doing what is necessary to make a transfer to a third country legal, for example because
- You do not have a valid transfer basis in place
- You lack the resources or expertise to carry out the necessary assessments
- You believe the outcome of the assessments requires additional measures, but don’t know which additional measures are sufficient
In such cases, it is illegal to transfer personal data to unauthorized third countries.”