European Court of Justice decision on Schrems II due
The European Court of Justice (ECJ) will today deliver a ruling on case C-311/18, also known as “Schrems II”, in one of the most highly anticipated decisions in the evolving realm of data protection.
The main parties involved—Austrian activist Max Schrems, the Irish Data Protection Commission (DPC) and Facebook Ireland Ltd.—had previously converged for the “Schrems I” case in 2015, which was filed over Facebook’s alleged violations of EU data protection laws. The landmark dispute led the ECJ to invalidate the Safe Harbor agreement, which had governed data transfers between the EU and the US. Today’s ruling is set to determine whether standard contractual clauses (SCCs) and Safe Harbor’s replacement (Privacy Shield) are viable means of transferring private data across the Atlantic.
Per the non-binding 2019 opinion of ECJ Advocate General (AG) Henrik Saugmandsgaard Øe, both the SCCs and the Privacy Shield currently constitute viable data conduits. However, the opinion emphasised the persistent challenges posed by US surveillance practices, which could potentially restrict European data outflows under the bloc’s current stipulations.
Expect the ruling to focus primarily on the SCCs, given the AG’s belief that a ruling can be submitted without an adjudication of the Privacy Shield. As roughly 88% of European data exporters rely on SCCs—particularly within the outsourcing space—today’s ruling could have serious ripple effects throughout post-pandemic economies. According to analysts, the overwhelming legal uncertainty that has long plagued overseas data transfers could incentivise the assessment of foreign protections on a case-by-case basis, as opposed to regional frameworks. The ECJ is expected to follow in the AG’s footsteps, uphold the validity of SCCs and shift responsibility to data controllers rather than supervisory bodies.
Wake up smarter with an assessment of the stories that will make headlines in the next 24 hours. Download The Daily Brief.
