Schrems II – It's Déjà Vu All Over Again

The more things change, the more they stay the same. On July 16, 2020, the Court of Justice of the European Union ("CJEU") issued its decision in the so called "Schrems II" case. If you need some background on the case, you can find our original blog post on the case here.  

The two main takeaways of the Schrems II decision are:

1. 1. The CJEU invalidated the EU-US Privacy Shield framework.

1. 2. The CJEU reaffirmed the validity of standard contractual clauses ("SCCs").

While the validity of SCCs were upheld, and remain a viable transfer mechanism, the CJEU holding requires businesses utilizing SCCs to analyze whether the destination country provides an adequate level of data protection.  Where the country doesn't, the business must provide additional safeguards or suspend the transfer. Similarly, EU data protection authorities must suspend or prohibit a transfer of personal data to a third country if the data protection authority has determined that