data protection report
Schrems II In July 2020, the Court of Justice of the European Union (CJEU) issued its long-awaited decision in the Data Protection Commission v Facebook Ireland case. The decision invalidated the European Commission’s previous adequacy decision for the EU-US Privacy Shield Framework and will have a significant impact on personal data transfers. The decision, colloquially known as Schrems II as it is the second legal challenge by the Austrian activist Max Schrems, ruled that “the Privacy Shield does not provide adequate protection” and the CJEU affirmed that it had found “for a second time now that there is a clash between EU privacy law and US surveillance law”. In the first Schrems decision in 2015, the Court invalidated the Safe Harbour framework that had governed EU-US personal data flows; Schrems II has now struck down Safe Harbour’s data protection-enhanced successor, Privacy Shield. The CJEU specifically
54
invalidated Decision 2016/1250, the European Commission’s 2016 decision that Privacy Shield was adequate to enable data transfers under US law. The decision also contradicts three years’ worth of annual reports from the Commission affirming the stance of their 2016 decision. The Commission had in the past raised its own issues with the Privacy Shield, for instance it had consistently argued that a permanent ombudsman should be appointed to fill the role of tribunal as specified within Article 47 of the EU Charter of Fundamental Rights.
With the Court now ruling that Privacy Shield is insufficient to govern the data sharing between the EU and the US, over 5,300 participants will be severely affected. Two main reasons were cited by the CJEU in their decision, pertaining to the all-encompassing nature of US surveillance and the lack of action EU citizens can take against the US if they are adversely affected. Firstly, the Court found that US surveillance programmes are not limited to strictly necessary data, despite their assessment by the Commission, thus meaning that they do not meet the requirements of Article 52 of the EU