The European Court of Justice held in the Schrems II case that the Privacy Shield is invalidated, but the possibility to rely on standard contractual clauses for data transfers needs to be assessed on a case by case basis.
The report of the EU Commission on the GDPR unveils a situation where Member States and data protection authorities still need to have a more consistent approach and exploit all the potentials of the EU privacy regulation.