Schrems II put the data transfer behind the contract

Privacy Shield had supplied an adequacy framework for covered transfers to participating US organisations. The court found that the protections assessed in that decision did not meet EU requirements. Its explanation addressed limits on access by US public authorities, the proportionality of surveillance programmes and the absence of sufficiently effective judicial redress. Those legal protections extended beyond what a commercial recipient could promise.

Standard contractual clauses survived because the mechanism contained duties to verify protection and to suspend transfers when the clauses could not be honoured. The court required protection essentially equivalent to that guaranteed within the EU. The assessment had to consider both the agreement and relevant aspects of the destination country's legal system. A contract between two businesses could not itself bind that country's public authorities.

The first decision concerned the product. Separating customer environments, reducing unnecessary personal data in logs or limiting overseas support access could require substantial work. Those changes might also make a supplier's answers more consistent across customers. Each deployment needed a realistic allowance for recurring legal and engineering effort; a compliance badge gave little indication of that cost.

The second concerned the operating model. A regional service can bring additional staffing, monitoring and recovery costs. A vendor that promises local administration must be able to support customers when the regional team is unavailable. Investors evaluating that promise would need to connect the proposed architecture to service commitments and gross margins. The judgment created no guarantee that customers would pay enough to cover those costs.

Article 49 derogations remained possible when their conditions applied. The EDPB stressed that consent had to be explicit, specific and informed about the transfer's risks. Relying on contractual necessity required objective necessity and occasional transfers. These provisions could not simply become the routine foundation for every recurring software operation. The judgment nevertheless left lawful routes for transfers to the United States when the relevant conditions were met.

The movement of data and the people with access to it needed to be established before selecting the legal basis. Customers could then examine which service performed the processing, what protection it provided and what would change if that arrangement became unsupportable. Those answers belonged in deployment design as well as in the contract.