After having studied #SchremsII (full judgment), the following aspects are noteworthy (thread): First, CJEU discusses whether EU law applies based on material scope (Art. 2 GDPR) and does not discuss territorial scope (Art. 3) - its relationship with transfers remains mysterious
Second, the CJEU logically finds that appropriate safeguard need to offer the same fundamental rights protection as an adequacy decision, and dismisses national law as relevant for constructing that standard, unless EU law refers to it (opening clauses for #freedomofspeech?)
Third, the SCC are valid, but the CJEU drops many hints that for the specific case of the US both the Irish DPA and the controller should end data flows because in the US there is no equivalent protection meaning neither adequacy nor appropriate safeguards are currently an option
Fourth, the CJEU gives another cryptic distinction of Arts. 7 and 8 Charter - privacy is engaged if there is personal data, while personal data protection when there is processing of data, both are interfered with when data are transferred or accessed by public authorities
