The invalidation of Privacy Shield Agreement and the conditional validity of standard contractual clauses under Schrems II Case reflect the confrontation between the Brussels effect of the EU’s data rules and the monitoring capitalism Matthew effect under US surveillance. Schrems II Case has actually formed the effect of “soft data localization”, whereas the mechanism of “soft data localization” in the EU has never been and should not be the goal it pursues. As the most important cross-border transfer mechanism of the European Union, the standard contractual clauses have profound domestic and international implications for the “basic+supplementary” path innovation based on the “risk method”. Faced with the two outcomes of the case, China’s latest cross-border data flows clauses adhere to the principle of free flows of cross-border data with data security as the bottom line, follow the structural design of “hard data localization”, and imitate the basic framework of EU transmission tools. In the design and implementation of specific rules, China should reasonably limit the expansion of “hard data localization”, learn from the modular method of risk regulation in the EU standard contractual clauses, and carefully design the standard contract clauses to provide the rule basis for China to participate in global data competition.