EU's Highest Court Upholds Standard Contract Clauses, but Strikes Down Privacy Shield
July 16, 2020
BRUSSELS-- Today, the European Court of Justice (“CJEU”) issued a landmark decision striking down the EU-U.S. Privacy Shield — an agreement between EU and U.S. authorities authorizing transfers of EU personal data to the United States — but upholding the validity of standard contractual clauses (“SCCs”), another mechanism that EU-based organizations use to transfer data internationally. Covington represents BSA | The Software Alliance (“BSA”) in the case, and key aspects of BSA’s arguments on the validity of SCCs were reflected in the Court’s decision.
The Court’s judgment, in Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (“Schrems II”), holds that the Privacy Shield does not take adequate account of U.S. laws authorizing public authorities to access data transferred from the EU to the United States. The Court also concludes that the ombudsperson mechanism referred to in the Privacy Shield Decision does not provide effective administrative or judicial redress for the data subjects concerned. The Court holds therefore that the Privacy Shield does not provide protections that are “essentially equivalent” to those set out in EU law — and invalidated the Privacy Shield with immediate effect. The judgment essentially decides the outcome of a separate case pending before the General Court, Case T-738/16, La Quadrature du Net and Others v. Commission, which focused directly on the validity of the Privacy Shield, and in which Covington also represented BSA.
In a separate part of its judgment, the Court upheld the validity of the SCCs, which many EU entities currently rely on to transfer data internationally. In doing so, the Court explained that use of the SCCs requires an assessment of the context of the transfer, including the laws of the country where the recipient is based and any additional safeguards adopted by the parties. In the Court’s words, EU law requires entities relying on the SCCs “to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data, whether the law of the third country of destination ensures adequate protection, under EU law, of personal data transferred pursuant to standard data protection clauses, by providing, where necessary, additional safeguards to those offered by those clauses.” (para. 134)
The Covington team representing BSA in these cases is led by partner Lisa Peets and includes Brussels and London lawyers Kristof Van Quathem, Bart Van Vooren, and Sam Jungyun Choi. Companies with questions on the impact of today’s decision should feel free to reach out to any member of the team.
Back
