The Court of Justice of the European Union (CJEU) invalidated
Decision 2016/1250, which found that the EU-US Privacy Shield
– a primary mechanism used by US companies to transfer
personal data from the EU to the US – provided adequate
protections for personal data. However, the Court still
“considers that Commission Decision 2010/87 on standard
contractual clauses for the transfer of personal data to processors
established in third countries as valid.” The press release
discussing the decision can be found here.
The decision at issue is Data Protection Commissioner v.
Facebook Ireland and Maximillian Schrems (Schrems
II). Maximillian Schrems is an Austrian national, and a
Facebook user. For Facebook users residing in the EU, some or all
of the user's data is transferred from Ireland to servers
located in the United States for processing. On two occasions,
Schrems submitted a complaint to the Irish data protection
authority (Irish DPA) essentially seeking to prevent
