[wbeckler]

The Schrems II ruling was that DPA+SCCs are insufficient for transferring data to a US company. You need to have "supplementary measures" in addition to the SCCs.