Extract to table

It must not be disclosed, copied, or distributed to any third party without the prior written consent of Calderwood & Harkness LLP and Northgate Telecommunications PLC

The Schrems II judgment invalidated the EU-US Privacy Shield framework and, while confirming the validity of Standard Contractual Clauses as a transfer mechanism in principle, established that data exporters must assess on a case-by-case basis whether the laws and practices of the destination country ensure an adequate level of protection, and must implement supplementary measures where necessary to bring the level of protection up to the EU standard

1 Current State Article 35(1) of the GDPR requires that, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons — particularly where it involves the use of new technologies, and taking into account the nature, scope, context, and purposes of the processing — the controller must carry out a data protection impact assessment prior to the processing

The voluntary nature of the platform must be carefully assessed given the workplace context

Develop a DPIA threshold assessment form that must be completed for all new processing activities, product features, AI models, and processor engagements, with escalation to the DPO for full DPIA determination