German court decision signals move toward risk-based approach to data transfers

A July decision by the Regional Court of Traunstein in Germany shows a more flexible approach to data transfers from the EU to the U.S. than has been taken by European data protection authorities. This decision contains several important findings and reflects a risk-based approach to Chapter V of the EU General Data Protection Regulation, which governs transfers of personal data to third countries. Importantly, the approach adopted by the Traunstein court contrasts with the "zero-risk" approach to data transfers adopted by DPAs since the Court of Justice of the European Union's "Schrems II" decision in 2020.

We briefly discuss the EU DPAs "zero-risk" approach to data transfers, before analyzing the findings of the Regional Court of Traunstein. A more detailed version of this article highlights that the Traunstein decision appears to be the latest judicial decision by an EU member state court that adopts a more flexible approach toward the interpretation of Chapter V of the GDPR.

The EU DPAs' "zero-risk" approach to data transfers

Since the "Schrems II" decision, European privacy regulators have adopted what has been described as a "zero-risk" approach to the enforcement of data transfers. DPAs have been asking companies transferring personal data outside the EU to "eliminate" all risks of access to such data by the intelligence and law enforcement agencies of foreign countries whose legal systems have not been deemed to include data protection legal safeguards that are essentially equivalent to those mandated by EU law.