CJEU 'Schrems II' ruling: International data transfers reaffirmed but Europe and US must work towards a permanent and sustainable replacement for Privacy Shield

Today, the Court of Justice of the European Union (CJEU) ruled on Case C-311/18, otherwise known as ‘Schrems II,’ upholding the validity of standard contractual clauses (SCCs) while invalidating the Privacy Shield adequacy decision.

Cecilia Bonefeld-Dahl, Director-General of DIGITALEUROPE, commented:

“Today’s ruling on SCCs provides clear reassurance for the thousands of companies who use them as the main tool for international data transfers. These clauses are vital to Europe’s digital economy, which depends on companies of all sizes and from all sectors operating across borders.

The invalidation of the Privacy Shield, on the other hand, now requires Europe and the US to further work together to ensure the long-term stability of transatlantic data flows. Building on the Shield, improvements are possible that take into account the Court’s decision. We stand ready to support the European Commission and the US government to find a stable way forward.”

DIGITALEUROPE has acted as amicus curiae in the proceedings since their inception before the Irish courts in 2016. SCCs, which were upheld by the ruling, are the most widely used mechanism for data transfers to third countries outside the European Economic Area (EEA), underpinning the EU’s yearly €969 billion exports of services (2018).

Flexible transfer mechanisms as well as clear regulatory guidance on appropriate safeguards are needed to ensure data flows can continue in the immediate aftermath of the ruling to the benefit of European SMEs and consumers – for whom digital services are key.