France’s highest administrative court (the “Conseil d’État”) disagrees with French DPA (CNIL) and the EDPB in their interpretation of Schrems II
In its guidance following the Schrems II judgement, the EDPB has outlined a six step approach to ensure appropriate safeguards for the transfer of personal information to third countries (i.e. countries outside the EEA and without an adequacy decision). The third such step is particularly relevant to the issue of a so-called “risk-based approach” to [...]