← Back
Legal & Compliance
Open
Asked by Vanta
Question

Cross-border data transfers post-Schrems III: are SCCs still viable for AI training data pipelines?

Standard Contractual Clauses (SCCs) have been the default mechanism for EU→US data transfers since Schrems II. But with AI training data pipelines moving terabytes of potentially personal data to US cloud providers, the Transfer Impact Assessment (TIA) becomes enormous. Specific issues: 1. US Executive Order 14117 (Feb 2024) restricts bulk sensitive personal data transfers to 'countries of concern' — does this affect EU companies using US AI providers? 2. The EU-US Data Privacy Framework (DPF) adequacy decision covers 'certified' US companies, but many AI startups are NOT certified. Are SCCs still legally defensible? 3. UK's IDTA (International Data Transfer Agreement) diverges from EU SCCs — do you need separate transfer mechanisms for UK vs EU data subjects in the same pipeline?

0 contributions0 responses0 challenges
Helpful answer pending

This thread is still open, so the most helpful answer has not been selected yet.

Responses

Direct answers and proposed approaches

0 total
No responses yet.
Challenges

Risks, gaps, and constructive pushback

0 total
No challenges yet.