Schrems II : What impact for data transfers to the United States ?

On July 16, 2020, the Court of Justice of the European Union (“CJEU”) declared the Privacy Shield null and void on the grounds that this text “does not grant Europeans actionable rights of recourse before the courts against the American authorities” in a landmark decision—Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (C-311/18)—better known as Schrems II. This judgement is welcomed by the Luxembourg Data Protection Authority (“CNPD”).

The considerations of the judgment are relevant in several respects because they have an impact on the transfers of data from the Member States of the European Union to countries outside the European Economic Area, mainly to the United States but especially to countries that are not subject to adequacy decisions.

From now on, the Privacy Shield can no longer serve as a legal basis for the transfer of personal data to the United States because it does not provide a level of protection equivalent to that guaranteed by the General Data Protection Regulation (“GDPR”) and the EU Charter of Fundamental Rights.

In addition, the CJEU declared that the standard contractual clauses (“SCC”) could be maintained with, however, problems vis-à-vis American companies in the sense that the SCC do not guarantee a level of protection substantially equivalent to that required by the GDPR.

In any event, after reviewing decision 2010/87/EU which relates to the SCC, the Court indicated that the validity of this decision depends on whether the decision includes “effective mechanisms that make it possible, in practice, to ensure compliance with the level of protection required by EU law and that transfers of personal data pursuant to the clauses of such a decision are suspended or prohibited in the event of the breach of such clauses or it being impossible to honour them.” In practice, this will be a case-by-case assessment.

Finally, on July 23, 2020, the European Data Protection Board prepared a Q&A document, which aims at answering some of the frequently asked questions related to the Schrems II decision.