2B Advice
TEL: +49 (228) 926165100
Privacy News

Schrems II Case: International Data Transfers Statement

What the New Opinion from the CJEU AG means for International Data Transfers

While Privacy Shield was seen to offer major improvements over Safe Harbor, it was still almost immediately contested by privacy advocates like Max Schrems. Additionally, Privacy Shield never received an adequacy decision the way Safe Harbor did before it. As of July 16th, 2020, the CJEU has passed judgement on Schrems II and invalidated Privacy Shield.

Why are International Data Transfers Important?

Data transfers between the EU and the US are at stake even more than ever. With Privacy Shield being struck down, Standard contractual clauses, are still deemed generally valid, but if a importer is not able to provide the guarantees given signing the model clauses, the importer is obliged by contract to notify the exporter so that the data transfer is stopped and the data subjects are notified. That is especially the case if national security laws prevent an adequate level of data protection and make it impossible to provide the guarantees the data importer signed up for. This is true for importers like Microsoft, Amazon, Google, Facebook, etc., that have to obey the Foreign Intelligence Surveillance Act (FISA).

It was made pretty clear that the Privacy Shield, just as the Safe Harbor certification was still rather a marketing tag than delivering the safeguards requested by the EU courts in the Safe Harbor decision and thus declared the Privacy Shield to  be invalid.

How We Can Help

Similar Blog Posts

Information Needed For Companies for the Whistleblower Directive Information Needed For Companies for the Whistleblower Directive

Initially, the EU Whistleblower Directive was supposed to be effective by December 17, 2021. However, the legislative process failed.

Right of Access by the Data Subject Right of Access by the Data Subject

The right of access, enshrined in Art. 15 of the GDPR, gives data subjects the right to obtain from the controller.

Subject Access Request Automation Subject Access Request Automation

Individuals have the right to access their personal data, commonly referred to as subject access. But can this process be automated?


Blog Categories