Schrems II is the CJEU judgment of 16 July 2020 (C-311/18) which declared the EU-US Privacy Shield invalid.
Key findings
The CJEU objected that US authorities can access data extensively on the basis of surveillance laws without EU citizens having effective legal remedies. The adequacy decision for the Privacy Shield was therefore invalid.
Standard contractual clauses remained valid. However, anyone using them must assess in each individual case whether the law of the recipient country permits an essentially equivalent level of protection and, where necessary, take supplementary measures.
Consequences
In 2021, the European Commission published new standard contractual clauses and the European Data Protection Board issued recommendations on supplementary measures. A new adequacy decision for the USA, the EU-U.S. Data Privacy Framework, followed on 10 July 2023.
The judgment is named after the Austrian lawyer Max Schrems. Following his complaint, the CJEU had already struck down the Safe Harbor agreement in 2015 (C-362/14, Schrems I).
Legal provisions
- CJEU, C-311/18
- Judgment of 16 July 2020, Schrems II.
- Arts. 45 and 46 GDPR
- Adequacy decision and appropriate safeguards.
- Arts. 7, 8 and 47 EU Charter of Fundamental Rights
- Fundamental rights against which the CJEU measured US law.
Related terms.
Standard contractual clauses (SCCs) Standard contractual clauses are model contracts issued by the European Commission that provide appropriate safeguards for transfers of personal data to third countries. Art. 46(2)(c) GDPR Third country In data protection law, a third country is any state outside the European Union and the European Economic Area. Art. 44 GDPR Cloud computing Cloud computing is the provision of IT resources such as storage, computing power or software over the internet by an external provider. Art. 28 GDPR 