Nederlands
English
French
Deutsch
Espaniol
Portugese
The Schrems II Legacy
The 2020 Schrems II ruling by Europe's top court invalidated the EU-US Privacy Shield, forcing companies to reassess transatlantic data flows. This landmark decision established that US surveillance laws didn't meet EU privacy standards under GDPR. Five years later, its ripple effects continue to shape global data protection enforcement.
Current Enforcement Landscape
In 2025, regulators worldwide have significantly stepped up GDPR enforcement. Notable developments include:
- Record €2.1 billion in GDPR fines issued in 2024
- Coordinated actions against big tech companies for illegal data transfers
- New guidelines on supplementary measures for international transfers
Compliance Challenges
Organizations face three major hurdles:
Data Transfer Mechanisms
The EU's new Data Privacy Framework faces ongoing legal challenges. Companies increasingly rely on Binding Corporate Rules (BCRs) and Standard Contractual Clauses (SCCs) with enhanced safeguards. Recent guidance requires documented Transfer Impact Assessments for all third-country data flows.
Cloud Service Compliance
Major cloud providers like AWS, Microsoft, and Google have introduced EU Data Boundaries, but questions remain about US government access possibilities. The IAPP Congress 2025 highlighted emerging solutions like digital sovereignty controls.
Emerging Regulations
Beyond GDPR, companies must navigate:
- Digital Markets Act (DMA) gatekeeper rules
- Data Act requirements
- Country-specific laws like China's PIPL
Global Enforcement Trends
Key patterns observed in 2025:
| Region | Enforcement Focus | Penalties |
|---|---|---|
| EU | Cross-border transfers, AI data processing | Up to 4% global revenue |
| US | Consumer privacy laws, children's privacy | State-level enforcement |
| Asia-Pacific | Data localization, breach notification | Combined civil/criminal penalties |
The Road Ahead
Privacy experts recommend:
- Conducting regular data mapping audits
- Implementing privacy-enhancing technologies
- Developing incident response playbooks
- Monitoring emerging legislation like the AI Act
As Max Schrems noted in a recent interview: "The battle for digital privacy remains dynamic - compliance isn't a destination but an ongoing journey."
