CJEU invalidation of the use of standard contractual clauses for data transfers to the U.S. would exponentially increase the risks of profound disruptions in international business, since it is widely believed that more companies, and certainly larger companies, rely upon such clauses than upon Safe Harbor as the legal basis for their data transfers. In addition, model contracts are the chief mechanism used by European companies to transfer personal data to third countries around the world. A CJEU ruling that standard contractual clauses cannot be utilized without consideration of the recipient country’s surveillance practices could jeopardize far more than business relationships with the United States.
And if model contracts go, can Binding Corporate Rules be far behind? Or consent? We live in interesting times. Hang on!