CJEU, judgment of 16 July 2020, C-311/18, Schrems II

The CJEU declares the EU-US Privacy Shield invalid and upholds the standard contractual clauses only on condition that the data exporter additionally assesses whether an equivalent level of protection is ensured in the third country. Basis of the obligation to carry out a transfer impact assessment.

In the case of Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, the CJEU (Grand Chamber) ruled on the requirements for transfers of data to unsafe third countries. The decision declares the EU-US Privacy Shield invalid and makes clear that the standard contractual clauses alone do not guarantee an adequate level of protection. It is the basis of the obligation to carry out a transfer impact assessment.

1. Facts

Maximillian Schrems challenged the transfer of the data collected about him by Facebook Ireland to the US parent company. He submitted that US law did not offer sufficient protection against access by state authorities. The Irish supervisory authority thereupon brought the matter before the High Court, which referred questions to the CJEU on the validity of the standard contractual clauses and of the Privacy Shield. At the heart of the case were the powers of access of the US intelligence services, in particular under Section 702 of the Foreign Intelligence Surveillance Act (FISA 702).

2. Decision

2.1 Privacy Shield invalid

The Court declared the adequacy decision on the EU-US Privacy Shield invalid. The possibilities of access available to the US intelligence services were not limited to what is necessary and proportionate, and the persons concerned lacked effective legal protection. That basis for data transfers to the United States thus ceased to exist.

2.2 Standard contractual clauses only with an additional assessment

The Court held the standard contractual clauses to be valid in principle. However, as a contract between the parties they cannot bind state authorities in the third country, and merely concluding them is therefore not sufficient. Before the transfer, the data exporter must assess whether a level of protection equivalent to that of the EU is actually ensured in the country of destination. Where the law or the practice in the country of destination stands in the way of this, supplementary protective measures are required; otherwise the transfer must be suspended.

3. Significance for practice

It follows from the judgment that, in addition to concluding the standard contractual clauses, a transfer impact assessment must always be carried out:

Concluding the standard contractual clauses alone is not sufficient.
The data exporter must assess the level of protection in the third country in the individual case, with particular regard to rights of access of state authorities.
For the United States, FISA 702 is to be classified as a problematic legal provision.
Where too high a risk remains despite supplementary protective measures, no transfer may take place.

Standard Contractual Clauses and Transfer Impact Assessment

Implementation of the Schrems II requirements: the four modules and the three-stage transfer impact assessment.

Transfers to Third Countries (Data Export)

Assessment framework and instruments for transfers to unsafe third countries.