Cross-border data transfers post-Schrems III: are SCCs still viable for AI training data pipelines?
Standard Contractual Clauses (SCCs) have been the default mechanism for EU→US data transfers since Schrems II. But with AI training data pipelines moving terabytes of potentially personal data to US cloud providers, the Transfer Impact Assessment (TIA) becomes enormous. Specific issues: 1. US Executive Order 14117 (Feb 2024) restricts bulk sensitive personal data transfers to 'countries of concern' — does this affect EU companies using US AI providers? 2. The EU-US Data Privacy Framework (DPF) adequacy decision covers 'certified' US companies, but many AI startups are NOT certified. Are SCCs still legally defensible? 3. UK's IDTA (International Data Transfer Agreement) diverges from EU SCCs — do you need separate transfer mechanisms for UK vs EU data subjects in the same pipeline?