In the immediate aftermath of the Schrems II judgement, Bruno Gencarelli (Head of the International data flows and protection unit at the European Commission) said that “Schrems II is data transfers from theory to practice”. There have been several major developments over the last couple of weeks (explained below) which show this to be an accurate assessment. Companies can no longer “do nothing” in the hope that the difficult implications will go away. Regulators are starting to investigate. Complaints are being submitted. A taskforce has been set up. The Swiss data protection authority (DPA) also thinks Privacy … Continue Reading
Topic: Data Transfer
Subscribe to Data Transfer RSS feedAn “enhanced” Privacy Shield is being negotiated – third time a charm?
On 10 August, the European Commission and the US Department of Commerce confirmed that talks have begun between the EU and US for an “enhanced” Privacy Shield.
This will be the third attempt to revise this framework, following the invalidation of Safe Harbor in 2015 and Privacy Shield in July 2020. Third time a charm? We’re not so sure.
By way of recap, in Schrems II, the court made clear that Privacy Shield was invalid for three main reasons:
- US surveillance rules are disproportionate
- There is a lack of proper oversight over US surveillance programmes
- EU individuals do not
Schrems II landmark ruling: our recommendations
On 16 July 2020, the Court of Justice of the European Union (CJEU) published its decision in the landmark case Data Protection Commissioner v Facebook Ireland Ltd, Maximilian Schrems and intervening parties, Case C-311/18 (known as the Schrems II case). While the EU-US Privacy Shield (Privacy Shield) has been completely invalidated, the Standard Contractual Clauses (SCCs) remain valid, but with strict conditions.
Our recent briefing provides a detailed analysis on the judgement, but here are our recommendations on what organisations should consider doing next:
- Monitor guidance updates from the European Data Protection Board (EDPB)
Schrems II: The US Perspective and where do we go from here?
Schrems II calls into question all transfers of personal information out of the EU that involve export to a country without an adequacy finding. While this affects countries in every region of the world, it does have particular ramifications for the US.
US companies are likely to bear the brunt of this decision. First, because the underlying complaint concerns how Facebook transferred personal data to the US, Schrems II takes particular umbrage with US “mass” surveillance laws, which are unlikely to change in the short term. Second, the US is still the largest economy in the world and information is … Continue Reading
