Key takeaways: EU-US Privacy Shield invalidated by the CJEU Standard Contractual Clauses found to be valid; however, additional clarifications provided Further guidance and statements expected Register for our reactionary webinar at 11 AM ET / 4.00 PM BST later today here The Court of Justice of the European Union ('CJEU') announced, on 16 July 2020, that it had issued its judgment in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('the Schrems II Case'). In particular, the CJEU declared the Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the Adequacy o
News
EU: CJEU Schrems II judgment invalidates Privacy Shield Decision and provides clarifications on SCCs
July 16, 2020
Summary
The Court of Justice of the European Union (CJEU) invalidated the EU-US Privacy Shield Decision and confirmed the validity of Standard Contractual Clauses (SCCs) with additional clarifications, emphasizing the need for data protection in line with EU law. The judgment requires companies to consider foreign data access laws when transferring data internationally and mandates supervisory authorities to suspend data transfers if EU law protection cannot be ensured. The CJEU also criticized the US surveillance programs for not being limited to what is strictly necessary and found the Ombudsperson mechanism inadequate for providing judicial protection to EU data subjects.