CJEU strikes down EU-US data transfer tool in Schrems v Facebook case

16/07/2020 | Reuters

Europe’s top court has rejected the validity of the EU-US Privacy Shield, set up in 2016 to protect Europeans personal data when it is transferred across the Atlantic for commercial use. 

Read the CJEU Press Release - The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield. 

Additional commentary and responses can be read in: 

16th July:

  • European Commission opening remarks at the press conference following the judgment.
  • IAPP reports on the 'Schrems II' decision: EU-US data transfers in question.
  • Reuters reports privacy campaigner Max Schrems welcomes the decision. 
  • The Guardian, which claims tech firms like Facebook may be required to restrict data sent from EU to US.
  • 11KBW Panopticon Blog declares Privacy Shield dead and provides a precise summary of the conclusion to this much-anticipated case. 
  • The Guardian publishes a full timeline of the key events in the nine-year campaign.
  • EDRi - European Digital Rights organisation EDRi hails the decision a victory for us all.
  • Privacy & Information Security Law Blog comments on how the outcome was unexpected. 
  • IAPP Schrems II backs the European legal regime into a corner. How can it get out?
  • IAPP confirm while CJEU invalidates EU-US Privacy Shield; SCCs remain valid.
  • IAPP has published a new Privacy Shield INVALID Infographic.
  • Reuters reports that Facebook is to study the court ruling on data transfers.
  • Open Rights Group asks what about the UK?
  • ICO has also issued a statement on Schrems II case.

17th July:

  • EDPB statement.
  • EDPS statement.
  • CNIL statement.
  • EDPB adopts statement on the CJEU's ruling in Facebook Ireland v Schrems.
  • IAPP President Omar Tene declares how the show must go on. 
  • 11KBW Panopticon Blog discusses more unhappy thoughts on Schrems II.
  • IAPP Privacy Advisor blog asks what Privacy Shield organisations should do now.
  • IAPP reaction between Max Schrems and Hogan Lovells Partner Eduardo Ustaran following CJEU's ruling on Privacy Shield, SCCs.
  • TechCrunch looks at how legal clouds are gathering over US cloud IT services.
  • Reuters reveals Mike Pompeo said to be 'deeply disappointed' with Privacy Shield invalidation.
  • WIRED predicts how the end of Privacy Shield spells trouble for Brexit Britain.

20th July:

  • NOYB watch Max Shcrems discuss the next steps for EU companies following CJEU ruling.
  • IAPP launch DPA and government guidance page on Schrems II.
  • IAPP more reaction as Irish DPC Helen Dixon and DLA Piper Partner Andy Serwin dissect CJEU ruling.
  • IAPP publishes article on what 'Schrems II' means for controller-to-processor SCCs.
  • IAPP asks what does 'Schrems II' mean for EU-UK data flows?

21st July:

  • IAPP asks what the Schrems II decision means for the UK securing an adequacy finding? 

22nd July:

  • IAPP asks whether the EU will become an information island?
  • IAPP discusses the impact of Schrems II on controller-to-controller SCCs
  • IAPP outline action steps US multinationals should take over the transfer of HR data. 

23rd July:

  • EDPB urges SAs and holders of BCRs to act ahead of the end of the transition period to ensure the BCRs can still be used as a transfer tool.
  • 11KBW Panopticon Blog highlights the need for organisations relying on BCRs using the ICO in the UK to act now and select an EU supervisory authority. 
  • IAPP post on how DPAs advise approaching SCCs.
  • IAPP post on BCRs as a robust alternative to Privacy Shield and SCCs.
Read Full Story

What is this page?

You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.

The Privacy Newsfeed monitors over 300 global publications, of which more than 4,250 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.

Freevacy has been shortlisted in the Best Educator category.
The PICCASO Privacy Awards recognise the people making an outstanding contribution to this dynamic and fast-growing sector.