Despite the burdensome risk assessments mandated by the European Data Protection Board’s supplementary measures guidance, personal data could still be exposed to state interception. Filed under IT & Data Protection Topics International transfers Surveillance Organisations European Commission European Court of Justice European Data Protection Board