CJEU decision on Schrems II: model clauses valid, privacy shield invalid

The CJEU ruling on the validity of the European Commission’s standard contractual clauses for international data transfers (SCCs) was announced today.

16.07.2020

The CJEU followed the AG’s opinion in declaring that the Commission decision approving the SCCs is valid.  However this does not automatically mean that all data transfers made under the SCCs are valid as the decision emphasises the obligations on controllers to suspend transfers if the clauses can’t be complied with (for example because of government surveillance programmes).  The CJEU has also ruled that the privacy shield is invalid.

Key points of the decision:
  • Data subjects whose data is transferred to a “third country” must be given a level of protection essentially equivalent to that guaranteed under the GDPR, read in the light of the Charter of Fundamental Rights
  • US government surveillance programmes and the limitations they are subject to do not meet the requirements of proportionality under EU law and do not grant data subjects actionable rights before the courts against the US authorities
  • The Ombudsperson mechanism provided for under the Privacy Shield does not provide a sufficient remedy to make up for this lack of actionable rights, so the Privacy Shield is invalid
  • Regarding transfers under the SCCs the assessment of the level of protection should take into account the protection given by the SCCs and also relevant aspects of the legal system of the destination country when considering access by the public authorities of that third country
  • The SCCs require data exporters and importers to verify, prior to any transfer, whether the level of protection “is respected in the third country concerned”.  Importers are obliged to notify exporters if they can’t comply with the SCCs, and controllers then have an obligation to suspend transfers.
  • Data Protection Authorities should suspend or prohibit transfers of data to a third country if they consider in all the circumstances that the SCCs aren’t or can’t be complied with in that third country and the protection of the data that is required by EU law cannot be ensured by other means
  • These suspension mechanisms enable the protection given by the SCCs to be effective, so the Commission decision approving the SCCs is valid.
What does this mean for business?
  • Identify all transfers taking place under Privacy Shield.  These are clearly invalid following the Decision, and it is advisable to put SCCs in place.
  • Businesses should ensure they have records of where they are sending data internationally under the SCCs and consider whether they are able to assess the level of protection for data in the destination countries
  • We may need to wait for further guidance from DPAs on their expectations in this area.   For example, if a third country such as the US doesn’t provide EU citizens with remedies against government requests for access to data, but a particular data importer has never been subject to requests for government access to data, can data transfers continue, or should they be suspended because of the theoretical possibility of access to data?  The answer may be highly relevant for companies which transfer purely administrative data relating to individuals to the US.
  • However it is likely that companies which are subject to regular requests from government for access to data (in particular in the communications/social media space) will have to re-consider where they store EU personal data
  • Although the focus to date has been on the US, it seems questionable whether companies will be able to justify sending data to countries with authoritarian regimes which do not have a reliably independent judicial system.