One year ago, on July 16, 2020, the Court of Justice of the
European Union (CJEU) issued a landmark decision in Data Protection
Commissioner v. Facebook Ireland and Maximillian Schrems (Schrems
II). At issue were data transfers between the EU and the U.S.
In a decisive blow to normal operating procedures for thousands
of U.S. businesses, the Schrems II court upended two mechanisms
that most companies relied on to transfer data – the EU-U.S.
Privacy Shield and standard contractual clauses (SCCs). The Privacy
Shield was determined inadequate for data privacy protection and
invalidated, effective immediately. While the court upheld the
validity of SCCs, it now requires each transfer be evaluated on a
case by case basis to ensure adequate protection. If lacking, the
court found, "additional safeguards" could be required;
however, no clarification was offered to indicate which
supplemental measures sufficiently protect a subject's
data.
