Schrems II – ECJ Ruling On Transfers Of Data: Validity Of Standard Contractual Clauses Upheld Yet Privacy Shield Framework Declared Invalid

The Court of Justice for the European Union in Schrems II has upheld the validity of standard contractual clauses (SCC) as a means of transferring personal data between the EU and third countries (i.e. non-EU countries) without additional safeguards, but has declared decision 2016/1250 on the adequacy of protection provided by the EU-US Data Protection Shield (commonly referred to as the "Privacy Shield") to be invalid.

This landmark decision is of universal interest. While the decision will come as a relief to organisations in third countries who rely on SCCs as a means of transferring data between the EU, the judgment stresses that SCCs will only be valid if the rights of data subjects can be upheld in the third country, requiring a thorough undertaking from data protection authorities in third countries to ensure this is the case. For US companies who rely on the now invalid Privacy Shield framework to transfer personal data belonging to EU data subjects, the