CJEU - C-311/18 - Facebook Ireland and Schrems
CJEU invalidates EU-US Privacy Shield, upholds SCCs with conditions.
The Court of Justice of the European Union (CJEU) invalidated Commission Decision 2016/1250, commonly known as the EU-US Privacy Shield. However, the court affirmed the validity of Standard Contractual Clauses (SCCs) for data transfers, provided they include effective mechanisms to ensure compliance with the GDPR's level of protection for EU citizens.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Facebook?
Get an email when a new story names Facebook, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU's Schrems II ruling invalidated the EU-US Privacy Shield framework, finding that US surveillance laws (e.g., FISA Section 702) do not provide equivalent protection to EU data subjects as required by GDPR. This ruling exposed thousands of organizations that relied solely on Privacy Shield as their legal transfer mechanism, leaving them temporarily without a valid basis for transatlantic data flows. The court's conditional validation of Standard Contractual Clauses (SCCs) underscores that legal instruments alone are insufficient — organizations must conduct Transfer Impact Assessments (TIAs) to verify real-world protection levels. This matters because non-compliant international data transfers can result in significant fines, enforcement actions, and reputational damage under GDPR.