Court of Justice of European Union Invalidates EU-US Privacy Shield

• 23/07/2020
• Articles

On 16 July 2020, the Court of Justice of the European Union (CJEU) delivered its judgment in the Facebook Ireland and Schrems case (C-311/18, Schrems II case). The CJEU invalidated Decision 2016/1250 on the adequacy of the protection provided by the EU-US Privacy Shield. The CJEU ruled that the EU-US Privacy Shield does not provide adequate protection and can therefore no longer serve as a legal instrument permitting the transfer of personal data from the EU to the US. As a result, transfers of personal data between the EU and the US that rely on the EU-US Privacy Shield are now illegal. However, the CJEU considered that Commission Decision 2010/87 on standard contractual clauses (SCCs) for the transfer of personal data to processors established in third countries is valid and can be relied upon, provided that the applicable legislation does not prevent the recipient from complying with its contractual obligations under the SCCs.

Please click below to read a note summarizing the CJEU's judgment.