The Court of Justice of the European Union (CJEU) is expected to publish its decision on the use of the European Commission’s Standard Contractual Clauses (SCCs) for international data transfers outside the EU/EEA on 16th July 2020.
These current proceedings originated from a case brought in 2013 by data protection activist, Mr. Schrems, to the Office of the Irish Data Protection Commissioner, now the Data Protection Commission (DPC), in relation to his Facebook data. His complaint centred around the legality of the transfer of his personal data by Facebook from its Irish incorporated company to the US, and the adequate protection of his personal data which is required under EU law.
The initial proceedings (Schrems I) were referred to the CJEU and resulted in a decision that the then existing Safe Harbour Framework was not a valid legal basis to transfer personal data between the EU and the US.
Following this decision, since organisations were unable to rely on Safe Harbour, many have been relying upon the SCCs and/or Privacy Shield, the latter in effect replacing Safe Harbour. The validity of these alternative mechanisms has been brought into question in the current proceedings (Schrems II) before the Irish High Court, which has referred several very interesting questions to the CJEU for a preliminary ruling.
The Advocate-General issued a non-binding Opinion in December 2019 that indicated the validity of both should be upheld, though it did appear that the way to achieve this would be onerous for both businesses and regulators. Accordingly, this decision will be watched around the world, as it is one of the most significant cases on data protection ever to have been heard.
Although the CJEU usually follows the Opinion of the Advocate-General, it does not always do so. Since the decision is likely to have an impact on how Privacy Shield can operate, the stakes are high. For our previous analysis on the proceedings to date and how businesses can address international personal data transfers, see our earlier article discussing the Advocate-General’s Opinion here. A full decision from the CJEU is set to be published on 16th July 2020 and we will post our updated analysis soon afterwards.
