Court decision · 16 July 2020
Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Schrems II)
Case C-311/18, ECLI:EU:C:2020:559 · Court of Justice of the European Union (Grand Chamber)
What it means for your code
Every non-EU processor (cloud, analytics, LLM API) needs a valid transfer mechanism and a documented transfer impact assessment.
What happened
The Court reviewed transfers of EU users' personal data to the United States under the EU-US Privacy Shield and Standard Contractual Clauses in light of US surveillance law.
What was decided
The Privacy Shield adequacy decision was invalidated. Standard Contractual Clauses remain valid, but exporters must assess whether the destination country's law undermines them and adopt supplementary measures or suspend the transfer.
The legal test applied
- Transfers to a third country require protection essentially equivalent to that in the EU
- Standard Contractual Clauses must be assessed against the destination country's law, with supplementary measures where needed
- Where adequate protection cannot be ensured, the exporter must suspend or end the transfer
What would have changed the outcome
- Transfers to US organisations certified under the EU-US Data Privacy Framework rely on the July 2023 adequacy decision instead
- Encryption with keys held only in the EU can be an effective supplementary measure
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.