Schrems II: Privacy Shield invalid, transfers under standard clauses only with essentially equivalent protection

What it is about

Question: may personal data be transferred to the United States under the Privacy Shield or under standard contractual clauses while US intelligence services have broad access? Ruling: the Privacy Shield decision (2016/1250) is invalid. The standard contractual clauses (Decision 2010/87) remain valid. However, the controller or processor in the EU must verify case by case, where appropriate together with the recipient, whether the law of the third country provides a level of protection essentially equivalent to that in the EU. If not, it must add supplementary measures or suspend or end the transfer. Where there is no valid adequacy decision and the controller or processor has not stopped the transfer itself, the supervisory authority must suspend or prohibit the transfer if that protection cannot be ensured by other means.

What this means in practice

For every transfer outside the EU under standard contractual clauses you must carry out and document an assessment of the law of the receiving country (transfer impact assessment). Where that law goes too far, you must add supplementary measures such as encryption with keys kept away from the recipient, or stop the transfer. For the US, the EU-US Data Privacy Framework (Implementing Decision 2023/1795) has served as the successor for certified organisations since July 2023, but the test from this judgment remains the standard for all other countries and for vendors not covered by that framework.

The GDPR articles concerned

• Article 2: Material scope
• Article 44: General principle for transfers
• Article 45: Transfers on the basis of an adequacy decision
• Article 46: Transfers subject to appropriate safeguards
• Article 58: Powers