BVwG - W171 2302513-1
Austrian court rules data transfer to US via SCCs insufficient for EU data protection.
An Austrian court has ruled that a media company's use of Standard Contractual Clauses (SCCs) and additional measures was insufficient to ensure EU-level data protection for personal data transferred to the USA. The court also found that the controller violated its information obligations under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPRhub?
Get an email when a new story names GDPRhub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn Austrian court ruled that a media company's reliance on Standard Contractual Clauses (SCCs) and supplementary measures did not adequately protect personal data transferred to the United States to the EU-equivalent standard required by GDPR. The ruling highlights that SCCs are not a blanket solution — organisations must conduct thorough Transfer Impact Assessments (TIAs) to verify that recipient country laws do not undermine the contractual protections. Additionally, the company failed its transparency obligations by not properly informing data subjects about these international transfers. This case reinforces that GDPR compliance for cross-border data flows requires ongoing due diligence, not a one-time contractual fix.