CJEU INVALIDATES EU-US DATA TRANSFERS UNDER GDPR FOR THE SECOND TIME
September 10, 2020
On July 16, 2020, the Court of Justice of the European Union (CJEU) found for a second time that the General Data Protection Regulation (GDPR) mechanisms for transferring personal data from the EU to the U.S. is invalid in Schrems and Facebook Ireland v Data Protection Commissioner, CJEU Case C-311/18 (Schrems II). Under the GDPR, before data transfers between EU members and third-countries is allowed, the European Commission must make an adequacy decision that the third country’s privacy laws are essentially equivalent to the rights and obligations under the GDPR. In Schrems II, the CJEU struck down the European Commission’s July 12, 2016 decision on the legal adequacy of the U.S.-EU Privacy Shield Framework.
A core issue in Schrems II cases was how national security agencies operate to preserve security and also ensure sufficient levels of privacy. The CJEU took issue with the U.S. government’s access to personal data for national security purposes, and specifically the rights of EU citizens in the U.S. to judicial review and redress. Until EU and U.S. officials are able to come to another agreement, and obtain another adequacy decision from the European Commission, the transfer of personal data from EU citizens to the U.S. will be limited. To address the potential impact of the decision the European Data Protection Board (EDPB) published a FAQ document, available here, on the implications of the decision. While the FAQ indicates that it may still be possible to transfer data to the U.S. pursuant to Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), in each case it will depend on the result of a case-by-case analysis of the circumstances surrounding the transfer, and whether the company can ensure that U.S. law would not impinge on the adequate level of protection. Finally, the CJEU’s decision does not relieve participants in the EU-U.S. Privacy Shield of their obligations under the EU-U.S. Privacy Shield Framework.
If you have any questions, please contact Evelyn Sahr (esahr@eckertseamans.com or 202-659-6622); Drew Derco (dderco@eckertseamans.com or 202-659-6665), or Andy Orr (aorr@eckertsemans.com or 202-659-6625).
Share This Post
Authors
