The blog is problematic. It came out pre-GDPR and doesn't reference GDPR.
It also has incorrect statements: "A simple attestation by the company along with referencing Privacy Shield creates compliance": No, really it does not.
So yes, would advise you to get a real DPO and Art 27 Rep in. They aren't expensive and with CCPA present now too, will likely be a good investment.
The blog poost is more an explanation about why we went to the EU Model Clause structure rather than Privacy Shield, and less a real explanation of Privacy Shield.
Our DPO can be reached at dpo@jumpcloud.com as is listed in our GDPR documentation above.
And (and to be clear this me me speaking, not the company, we've got a lot of brouhaha going on with WWDC, etc), but my understanding is that you don't need an Art 27 Rep if you have a physical presence in the EU and specify have a contactable DPO.
Privacy shield is an ALTERNATIVE method of to GDPR compliance for legal controls (other alternatives are SCCs/BCRs etc). US companies can either do Privacy Shield or implement GDPR themselves.
You are correct on their lack of an Art 27 Rep however.
What court wording are you referencing? The judgment says "private home page which is none the less accessible to anyone who knows its address", a very different turn of phrase.
I meant do you have a source for the court notes where they said that. It doesn't sound like a quote to me, it sounds like a precis.
In fact it sounds like a precis of the quote I provided, but I could also imagine the defendant's lawyer saying it in the more loaded way presented here.
