▪ Standard contractual clauses (SCCs), often called “model contracts,” are pre-approved legal provisions for transferring personal data from the EU to the rest of the world in compliance with the EU’s General Data Protection Regulation.

▪ SCCs are among the most widely used legal mechanisms for transferring personal data out of the EU. Firms from a broad range of sectors and countries rely on SCCs—not just consumer-facing companies from the United States.

▪ Europe’s high court hasn’t invalidated SCCs, but in Schrems II it noted the need for “supplementary measures.” Now the EU is considering measures that would make SCCs costlier and overly restrictive for transfers to the United States.

▪ The Irish Data Protection Commission’s initial reaction to Schrems II—ordering Facebook to stop using SCCs to transfer data to the United States—shows how transatlantic digital trade may be further undermined after Privacy Shield’s demise.

▪ SCCs now face growing scrutiny and potential reforms that could mean U.S. firms will no longer be able to provide services to EU consumers, and EU businesses will be unable to pursue opportunities that may require data transfers to America.

▪ By making data transfers so complicated, costly, and uncertain, the EU risks creating the world’s largest de facto data localization requirement—and SMEs and start-ups will shoulder a disproportionate share of the burden.