This case marks one episode in a succession of rulings
opposing the privacy rights of activist Maximilian Schrems to
Facebook Inc. For more information, regarding the hearing leading
towards last week's ruling click here.
This case is not only about the invalidation of the
EU-US Privacy Shield but also has an impact on the manner in which
EU standard contractual clauses may have to be implemented in the
future.
Since May 2018, the General Data Protection Regulation (EU)
2016/679 of 27 April 2016 ("GDPR") has
set new standards in terms of data protection. Pursuant to the
GDPR, personal data cannot,in principle, be transferred to
recipients outside of the European Union
("EU") except if (i) there is a decision
by the European Commission certifying that the destination country
offers an adequate level of data protection (Article 45 GDPR) or,
failing this, (ii) appropriate safeguards are in place such as SCCs
or binding corporate rules (Article 46 and 47 GDPR) or,
