- Schrems II turned on US surveillance law and the lack of effective redress, not on where bytes rest on disk.
- A transfer happens the moment personal data is made accessible to a recipient in a third country, including remote access and transient processing.
- LLM inference needs plaintext, which puts it squarely in the scenario where the EDPB found no effective technical supplementary measure.
- The defensible position is to keep the processing itself inside the jurisdiction and to be able to prove it, request by request.
What the Court actually decided
On 16 July 2020, in Case C-311/18, the Court of Justice invalidated the EU-US Privacy Shield and kept the standard contractual clauses alive on a condition. The condition is the part most engineering teams never read. An exporter relying on Article 46 SCCs has to assess, case by case, whether the law of the destination country lets the importer actually honour those clauses. Where it does not, the exporter must add supplementary measures or stop the transfer.
The reasoning that sank Privacy Shield was about US law, specifically surveillance programmes run under Section 702 of FISA and Executive Order 12333. The Court found that access by US authorities was not limited to what is strictly necessary and proportionate, and that EU data subjects had no effective remedy before an independent body, as Article 47 of the Charter requires. Nothing in that analysis depends on whether the data sits in a database in Virginia or passes through a GPU for four hundred milliseconds.
The question is access, not address
I still sit in procurement calls where the vendor answer to a Chapter V question is a storage diagram. Data at rest in Frankfurt, backups in Dublin, therefore no transfer. That reasoning confuses residency with transfer. The EDPB's Guidelines 05/2021 on the interplay between Article 3 and Chapter V describe a transfer as personal data being transmitted or made available by an exporter to an importer in a third country. Remote access counts. So does processing that never writes anything to disk.
For AI features the practical consequence is blunt. If your application sends a prompt containing a customer's name, account history and complaint text to a model endpoint operated in the United States, you have made a transfer, whatever your storage map says. If the endpoint sits in the EU but the operator can be compelled to hand over what it processes, you have a different problem, which we come back to in the next post on why an EU region is not the same thing as sovereignty.
- Ask where the data is processed in the clear, not where it is stored.
- Ask which legal entities can access it during processing, including support and abuse-monitoring staff.
- Ask which laws can compel those entities, and whether the compulsion reaches data held outside their home country.
Why inference is the worst case
EDPB Recommendations 01/2020, adopted in final form in June 2021, walk through use cases for supplementary measures. Encryption where the importer never holds the key works for backup storage. Pseudonymisation works when the importer cannot reidentify. Then there is the use case that matters to every AI team: transfer to a cloud provider or other processor that needs access to the data in the clear to perform its task. For that scenario the Board said it was incapable of envisioning an effective technical measure where the importer's country grants authorities disproportionate access.
A large language model is exactly that kind of processor. It cannot reason over ciphertext. Homomorphic encryption is nowhere near usable for transformer inference at production scale, and confidential computing enclaves, while useful, shift the trust question to the hardware vendor and the operator's attestation chain rather than removing it. If the plaintext prompt exists in memory on infrastructure reachable by a third-country authority, contractual promises and encryption in transit do not change the analysis.
Where the Data Privacy Framework changed things, and where it did not
The Commission adopted the EU-US Data Privacy Framework adequacy decision on 10 July 2023, built on Executive Order 14086 and the Data Protection Review Court. For a US importer that has self-certified under the DPF, transfers can rest on adequacy rather than SCCs plus a transfer impact assessment. That is a real change, and teams should use it where it applies.
It does not apply to everyone. A model provider that is not DPF-certified, or a subprocessor chain that includes one, puts you back on SCCs and the full Schrems II assessment. The framework also faces ongoing legal challenge, and DPOs who lived through Safe Harbor falling in 2015 and Privacy Shield in 2020 will reasonably ask what the fallback is. An architecture that only works while one adequacy decision survives is a bet, not a control.
What a defensible architecture looks like
The cleanest answer to an access question is to make sure there is no third-country access to answer for. For inference that means three things working together. The request is resolved to a model endpoint in the data subject's jurisdiction before it leaves your network. Failover stays inside that jurisdiction, so a regional outage degrades service instead of quietly moving prompts across the Atlantic. And identifiers that do not need to reach the model are pseudonymised on the way out, with the mapping held where the data originated.
This is the design YTT Secunet is built around, but the principle stands without us. Whatever you run, the routing decision has to be made per request by something that knows the tenant's domicile and the sensitivity of the payload, and it has to leave evidence. A diagram drawn for an audit describes intent. A signed record of where each request was resolved describes what happened.
What to put in the transfer impact assessment
If some of your inference traffic does leave the EEA, the TIA has to carry real content. Name the importer and every subprocessor in the chain. Identify the transfer tool for each hop, whether DPF certification, Article 46 SCCs under Commission Implementing Decision (EU) 2021/914, or something else. Assess the destination law against the specific data categories you send, which for prompts often includes free text you do not control. Then describe the supplementary measures and be honest about which ones survive the in-the-clear problem.
For traffic that stays in-region, the TIA becomes short, and the evidence moves to your Article 30 records and your DPIA: which endpoints, which jurisdictions, which policy decided it. That is a far better conversation to have with a supervisory authority than defending why a storage diagram should outweigh a Court of Justice judgment.