CJEU Invalidates Privacy Shield, But Upholds SCCs With Conditions

On July 16, 2020, in the case colloquially known as "Schrems II," the Court of Justice of the European Union (CJEU) struck down the EU-US Privacy Shield, finding it an invalid mechanism for transferring data from the EU to the US. The CJEU concluded that the Standard Contractual Clauses (SCCs) are valid for the transfer of personal data outside the EU (which would include transfers to the US), with certain conditions.

Brief Background

The Schrems II case followed closely on the heels of the CJEU's decision in Schrems I (October 2015), which invalidated the EU-US Safe Habor Framework. In Schrems I, a key concern was that EU personal data might be at risk of being accessed and processed by the U.S. government once transferred. Schrems II then challenged the validity of SCCs for similar reasons advanced in Schrems I. The EU-US Privacy Shield was adopted in July 2016.