Following this decision, the European Data Protection Board provided draft guidance for international transfers of data with different steps to follow, and the European Commission published updated Model Clauses. Both of these remain subject to the outcome of public consultations. In the meantime, considerable uncertainty remains as to how best to legally transfer personal data outside the European Economic Area. Consequently, some European companies are starting to think afresh about where their data is – and should ideally be – hosted. Some global companies may need to rethink their internal organisation and structure in order to assess whether they need to transfer personal data globally, and if so, how they can legally do so. It remains to be seen whether EU-based providers will gain an advantage from this in the longer term.

Opening up access to data, whether this data is personal or non-personal data, can create opportunities for technological advancement and the deployment of new products and services. However, natural tensions exist between opening up access to data and protecting intellectual property rights, confidentiality and individuals' privacy. The EU's proposed Data Governance Act aims to address some of these challenges through an enabling legislative framework and trusted data sharing mechanisms. There are four areas to the proposal: the reuse of public sector data subject to rights such as data protection legislation, intellectual property, trade secrets or other commercially sensitive information; a regime for data intermediaries; data altruism; and the development of a European Data Innovation Board. On the one hand, businesses acting as data intermediaries would face additional compliance requirements as a result of the Act's regulatory framework, and would no longer be able to use gathered data for their own ends. On the other, other businesses, particularly smaller enterprises, may be presented with opportunities to benefit from data they wouldn't otherwise have access to.

From our perspective, 2021 will see a continued focus on opening up access to data and harmonised compliance across the EU, to facilitate cross-border data sharing, while seeking to protect commercial interests and privacy. The only certainty concerning international transfers of personal data seems to be that there is no certainty: Both exporters and importers of personal data will need to carry out a case-by-case analysis rather than just relying on template documentation such as Standard Contractual Clauses.