On 16 July 2020, the European Court of Justice ("ECJ") declared the "adequacy decision" as invalid regarding the level of protection in the processing of personal data when data is transferred from the European Union ("EU") to the United States of America ("USA"), also known as the "Privacy Shield" and adopted by the European Commission in 2016.
In particular, the Court found that U.S. law does not comply with the equivalent principle of protection required by EU rules, given that public authorities in the U.S. may access the transferred personal data, without particular limitations, for reasons linked to internal security.
The Schrems II judgment now establishes that European companies that transfer personal data to the USA shall now reassess this transfer in the light of the new indications imposed by the ECJ. In particular, the validity of the standard contractual clauses has been confirmed, specifying however that a level of protection, subject to verification, has to be guaranteed that is substantially equivalent to that guaranteed in the EU by the General Data Protection Regulation 2016/679 ("GDPR").
In other words, companies may be able to make use of the standard contractual clauses only once compliance with the GDPR's data transfer provisions has been verified.
The European Data Protection Board ("EDPB") has promptly developed guidelines, providing useful advice and clarifying certain parts of the judgment in question. For example, it is specified that it is possible to use the exceptions provided for in Art. 49 of the GDPR, among which the transfer based on consent or for the purpose of executing a contract.
The consequences of this ruling are of great importance. In fact, to date, any transfer to the USA is unlawful if it is not assessed in the light of the new principles expressed by the ECJ through the ruling of Schrems II.
Given the ECJ interpretation regarding data transfers to the USA, have you already verified your compliance with EU law?
Originally published 26/10/2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.