Schrems II Confirms Validity Of EU Standard Contractual Clauses, Invalidates EU–U.S. Privacy Shield

In Short

The Situation: The Court of Justice of the European Union ("CJEU") has ruled that international data flows under the European Union's comprehensive data protection regime, the GDPR, can continue to be based on EU Standard Contractual Clauses if properly monitored, while the EU–U.S. Privacy Shield has been declared invalid.

The Issues: The future of international data flows and use of data transfer mechanisms, in particular between the European Union and the United States, has been called into question.

Looking Ahead: EU Data Protection Authorities are expected take a closer look at companies exporting personal data outside the European Union/European Economic Area ("EU/EEA"). As it is currently unclear whether a grace period for enforcement will be granted, companies that were relying on the EU–U.S. Privacy Shield for data transfers to the United States should swiftly implement suitable alternative safeguard mechanisms.