[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ft8vEqqxF-MiSjj9Z-Xx_gF8lqmENOz_NQpOH564IcAg":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"976c4eaf-0fd4-405c-bd08-f9b9cc2905d7","BVwG - W171 2302513-1","bvwg-w171-2302513-1-2e4140","Amendments to short summary ← Older revision Revision as of 07:41, 17 June 2026 Line 70: Line 70: }} }} A court determined that although a controller had used Standard Contractual Clauses and implemented additional measures for the transfer of a data subject’s personal data to the USA, these did not ensure EU-level data protection equivalency. It also found that the controller violated its information obligations. A court held that although a media company had used Standard Contractual Clauses and implemented additional measures for the transfer of a data subject’s personal data to the USA, it did not ensure a level of data protection equivalent to the EU. == English Summary == == English Summary ==","An Austrian court has ruled that a media company's use of Standard Contractual Clauses (SCCs) and additional measures was insufficient to ensure EU-level data protection for personal data transferred to the USA. The court also found that the controller violated its information obligations under GDPR.","Austrian court rules data transfer to US via SCCs insufficient for EU data protection.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W171_2302513-1&diff=51891&oldid=51872","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-06-17T07:41:10+00:00","2026-06-17T08:00:25.385094+00:00",7,[17,20],{"name":18,"type":19},"GDPRhub","vendor",{"name":21,"type":22},"Standard Contractual Clauses","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,31,36,41],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":66},"austrian-court-sccs-alone-insufficient-for-gdpr-compliant-us-data-transfers","Austrian Court: SCCs Alone Insufficient for GDPR-Compliant US Data Transfers","An Austrian court ruled that a media company's reliance on Standard Contractual Clauses (SCCs) and supplementary measures did not adequately protect personal data transferred to the United States to the EU-equivalent standard required by GDPR. The ruling highlights that SCCs are not a blanket solution — organisations must conduct thorough Transfer Impact Assessments (TIAs) to verify that recipient country laws do not undermine the contractual protections. Additionally, the company failed its transparency obligations by not properly informing data subjects about these international transfers. This case reinforces that GDPR compliance for cross-border data flows requires ongoing due diligence, not a one-time contractual fix.",[56,57,58,59,60,61,62,63,64,65],"GDPR Article 13 – Information obligations to data subjects","GDPR Article 14 – Information where data not obtained from the data subject","GDPR Article 44 – General principle for transfers","GDPR Article 46 – Transfers subject to appropriate safeguards (SCCs)","GDPR Article 49 – Derogations for specific situations","EDPB Recommendations 01\u002F2020 on Transfer Impact Assessments","NIST Privacy Framework PR.PO-P4 – Data processing policies and procedures","NIST SP 800-53 PT-7 – Specific categories of personally identifiable information","ISO\u002FIEC 27701:2019 – Section 8.5 (PII transfers to third parties)","CIS Control 3 – Data Protection",{}]