Client Alert Client Alert

CJEU invalidates EU-US privacy shield framework and introduces further restrictions on data transfers to non-EU countries

On 16 July 2020, the Court of Justice of the European Union (CJEU) issued a long-awaited decision in a dispute between Facebook Ireland, the Irish Data Protection Authority and the Austrian data protection activist Maximilian Schrems.

Mr. Schrems filed a complaint in 2013 seeking to ban or restrict transfers of his personal data from the EU to third countries, specifically to the United States. Like many other internet service providers, Facebook had based data flows on the “EU-US Privacy Shield” Framework (“Privacy Shield”) and EU model clauses for data transfers (Standard Contractual Clauses, “SCC”). The CJEU now invalidated “Privacy Shield” and clarified the requirements when employing SCC.

For more details, please open the attached file.

Read the full text

Download PDF