July 20, 2020

The General Data Protection Regulation (2016/679/EU) provides that personal data can only be transferred to a third country if the third country in question ensures an adequate level of data protection.

Under Article 45 of the GDPR, the EU Commission can decide that a third country ensures, by reason of its domestic law or international commitments, an adequate level of protection. Article 46 provides that, in the absence of such an adequacy decision, the transfer of personal data can only take place if the personal data exporter established in the EU has provided appropriate safeguards, e.g. by the use of standard data protection clauses adopted by the Commission, and if data subjects have enforceable rights and effective legal remedies. Article 49 of the GDPR sets out the conditions under which a transfer can take place in the absence of an adequacy decision or appropriate safeguards.

Maximilian Schrems, an Austrian national residing in Austria, has been a Facebook user since 2008. As with other users residing in the EU, some or all of Mr Schrems’s personal data is transferred by Facebook Ireland to servers belonging to Facebook Inc located in the United States, where it undergoes processing. Mr Schrems complained to the Irish Data Protection Commission, in essence, to try and stop the transfers. He claimed that US law and practices do not offer sufficient protection against access by public authorities to data transferred there. The complaint was rejected on various grounds, including the fact that, in Commission Decision 2000/5205 (the Safe Harbour Decision), the EU Commission had found that the US ensured an adequate level of protection.

In a judgment dated 6 October 2015, the CJEU, to which the High Court (Ireland) had referred questions, declared the Safe Harbour Decision to be invalid (Case C-362/14 Maximillian Schrems v Data Protection Commissioner EU:C:2015:650 (Schrems I). Following Schrems I and the Irish court’s subsequent annulment of the decision rejecting Mr Schrems’s complaint, the Irish Data Protection Commission asked Mr Schrems to reformulate his complaint in the light of the declaration that the Safe Harbour Decision was invalid. In his reformulated complaint, Mr Schrems claimed that the US did not offer sufficient protection of data transferred to it. He sought the suspension or prohibition of future transfers of his personal data from the EU to the US, which Facebook Ireland undertook pursuant to standard contractual clauses set out in Commission Decision 2010/87.

Given that the outcome of Mr Schrems’s complaint depended on the validity of Decision 2010/87, the Irish Data Protection Commission brought proceedings before the Irish High Court in order for it to refer questions to the CJEU for a preliminary ruling. After those proceedings had been issued, the Commission adopted Decision 2016/1250 on the adequacy of the protection provided by the EU-US Privacy Shield (the Privacy Shield Decision).

The Irish High Court asked the CJEU whether the GDPR applies to transfers of personal data pursuant to the standard data protection clauses in Decision 2010/87, what level of protection is required by the GDPR in connection with such a transfer, and what obligations are incumbent on supervisory authorities in those circumstances. The High Court also questioned the validity of both Decision 2010/87 and the Privacy Shield Decision.

In its judgment released last week, CJEU found that examination of Decision 2010/87 in the light of the Charter of Fundamental Rights disclosed nothing to affect its validity. However, the CJEU found that the Privacy Shield Decision was invalid.

The CJEU found that even where the third country, to which personal data is transferred from an economic operator in the EU, processes that data for the purposes of public security, defence and State security, the GDPR applies to the transfer. In other words, the CJEU said, this type of data processing by the authorities of a third country does not preclude the initial transfer of the data from the scope of the GDPR.

Regarding the level of protection required in respect of such a transfer, the CJEU held that the GDPR’s requirements of appropriate safeguards, enforceable rights and effective legal remedies means that data subjects whose personal data are transferred to a third country pursuant to standard data protection clauses must be afforded a level of protection essentially equivalent to that guaranteed within the EU by the GDPR, read in the light of the Charter. The CJEU held that in those circumstances that the assessment of that level of protection must take into consideration the relevant aspects of the legal system of that third country.

As for the obligations of supervisory authorities, the CJEU held that, unless there is a valid Commission adequacy decision, the authorities are required to suspend or prohibit a transfer of personal data to a third country where they take the view that, in all the circumstances, the standard data protection clauses cannot be complied with in that country and that the level of protection required by EU law cannot be ensured by other means.

As for Decision 2010/87, the CJEU held that its validity is not called into question by the mere fact that the standard data protection clauses in that decision do not, given that they are contractual in nature, bind the authorities of the third country to which data can be transferred. However, that validity depends on whether the Decision includes effective mechanisms to make it possible, in practice, to ensure compliance with the level of protection required by EU law, and that transfers of personal data pursuant to such clauses are suspended or prohibited in the event of a breach or it becoming impossible to honour them. The CJEU found that Decision 2010/87 did indeed establish these mechanisms.

The CJEU pointed out, in particular, that Decision 2010/87 obliges both the data exporter and the recipient of the data to verify, prior to transfer, whether that level of protection is respected in the third country concerned. The Decision also requires the recipient to inform the data exporter of any inability to comply with the standard data protection clauses, in which case the latter is obliged to suspend the transfer of data and/or to terminate the contract with the former.

Finally, the CJEU considered the validity of the Privacy Shield Decision in the light of the GDPR and the provisions of the Charter guaranteeing respect for private and family life, personal data protection and the right to effective judicial protection. The CJEU noted that the Privacy Shield Decision enshrines the position, as the Safe Harbour Decision did, that the requirements of US national security, public interest and law enforcement have primacy, thus condoning interference with the fundamental rights of people whose data are transferred to that third country. In the CJEU’s view, the limitations under US law on the access and use by US public authorities of data transferred from the EU are not equivalent to EU requirements insofar as the US surveillance programmes based on those provisions are not limited to what is strictly necessary.

As for the requirement of judicial protection, the CJEU held that, contrary to the view taken by the Commission in the Privacy Shield Decision, the Ombudsperson mechanism referred to in that Decision does not provide data subjects with any cause of action before a body that offered guarantees substantially equivalent to those required by EU law, such as to ensure the independence of the Ombudsperson and the existence of rules empowering the Ombudsperson to adopt decisions binding on the US intelligence services. On all these grounds, the CJEU declared the Privacy Shield Decision invalid. (Case C-311/18 Data Protection Commission v Facebook Ireland Ltd EU:C:2020:559 (16 July 2020) — to read the judgment in full, click here).