After having studied #SchremsII (full judgment), the following aspects are noteworthy (thread): First, CJEU discusses whether EU law applies based on material scope (Art. 2 GDPR) and does not discuss territorial scope (Art. 3) - its relationship with transfers remains mysterious Second, the CJEU logically finds that appropriate safeguard need to offer the same fundamental rights protection as an adequacy decision, and dismisses national law as relevant for constructing that standard, unless EU law refers to it (opening clauses for #freedomofspeech?)