You Want Answers? EDPB FAQ on CJEU Schrems II Decision

Editor’s Note: The European Data Protection Board (EDPB) is an independent European body, which contributes to the consistent application of data protection rules throughout the European Union, and promotes cooperation between the EU’s data protection authorities. Recently, in response to the Court of Justice of the European Union (CJEU) judgment in the landmark Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Schrems II) case, the EDPB published a frequently asked questions (FAQ) document designed to provide initial clarification and preliminary guidance on the judgment. Provided for your review and use is a complete copy of this recently published FAQ.

Taken from the European Data Protection Board (EDPB), Chair Andrea Jelinek

European Data Protection Board Publishes FAQ Document on CJEU Judgment C-311/18 (Schrems II)

Document Extract

This document aims at presenting answers to some frequently asked questions received by supervisory authorities (“SAs”) and will be developed and complemented along with further analysis, as the EDPB continues to examine and assess the judgment of the Court of Justice of the European Union (the “Court”).

The judgment C-311/18 can be found here, and the press release of the Court may be found here.

What did the Court rule in its judgment?

In its judgment, the Court examined the validity of the European Commission’s Decision 2010/87/EC on Standard Contractual Clauses (“SCCs”) and considered it is valid. Indeed, the validity of that decision is not called into question by the mere fact that the standard data protection clauses in that decision do not, given that they are contractual in nature, bind the authorities of the third country to which data may be transferred.

However, that validity, the Court added, depends on whether the 2010/87/EC Decision includes effective mechanisms that make it possible, in practice, to ensure compliance with the level of protection essentially equivalent to that guaranteed within the EU by the GDPR and that transfers of personal data pursuant to such clauses are suspended or prohibited in the event of the breach of such clauses or it being impossible to honor them.

In that regard, the Court points out, in particular, that the 2010/87/EC Decision imposes an obligation on a data exporter and the recipient of the data (the “data importer”) to verify, prior to any transfer, and taking into account the circumstances of the transfer, whether that level of protection is respected in the third country concerned, and that the 2010/87/EC Decision requires the data importer to inform the data exporter of any inability to comply with the standard data protection clauses, and where necessary with any supplementary measures to those offered by those clause, the data exporter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the data importer

The Court also examined the validity of the Privacy Shield Decision (Decision 2016/1250 on the adequacy of the protection provided by the EU-U.S. Privacy Shield), as the transfers at stake in the context of the national dispute leading to the request for preliminary ruling took place between the EU and the United States (“U.S.”).

The Court considered that the requirements of U.S. domestic law, and in particular certain programs enabling access by U.S. public authorities to personal data transferred from the EU to the U.S. for national security purposes, result in limitations on the protection of personal data which are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law, and that this legislation does not grant data subjects actionable rights before the courts against the U.S. authorities.

As a consequence of such a degree of interference with the fundamental rights of persons whose data are transferred to that third country, the Court declared the Privacy Shield adequacy Decision invalid.

Review the Complete FAQ Document (PDF)

Read the original FAQ from the European Data Protection Board 

Additional Reading

• CJEU Invalidates Decision on the Adequacy of Protection Under EU-US Data Protection Shield
• The Age of Consent? European Data Protection Board Guidelines on Consent Under the GDPR

Source: ComplexDiscovery