On July 16, 2020, within the case colloquially often known as “Schrems II,” the Courtroom of Justice of the European Union (CJEU) struck down the EU-US Privateness Defend, discovering it an invalid mechanism for transferring information from the EU to the US. The CJEU concluded that the Customary Contractual Clauses (SCCs) are legitimate for the switch of private information outdoors the EU (which would come with transfers to the US), with sure circumstances.
The Schrems II case adopted intently on the heels of the CJEU’s choice in Schrems I (October 2015), which invalidated the EU-US Protected Habor Framework. In Schrems I, a key concern was that EU private information is perhaps prone to being accessed and processed by the U.S. authorities as soon as transferred. Schrems II then challenged the validity of SCCs for related causes superior in Schrems I. The EU-US Privateness Defend was adopted in July 2016.
With regard to the SCCs, the CJEU judgment primarily adopted the CJEU’s Advocate Basic’s non-binding opinion printed on December 19, 2019. The CJEU acknowledged that the SCCs present ample safety for EU private information, however emphasised the truth that EU organizations counting on them have an obligation to take a proactive function in evaluating, prior to any switch, whether or not there’s the truth is an “sufficient degree of safety” for private information within the importing jurisdiction. The CJEU famous that organizations could implement extra safeguards, over and above these contained within the SCCs – though it’s unclear what these safeguards would possibly embrace. The ruling additionally highlights the function that supervisory authorities ought to absorb assessing and, the place mandatory, suspending and prohibiting transfers of private information to an importing jurisdiction. Many anticipate that this choice will end in modifications to the usual contractual clauses, one thing that had been beneath dialogue previous to the choice (because the SCCs predate GDPR).
Whereas the CJEU AG’s view was that the CJEU shouldn’t be required to rule on the validity of the EU-US Privateness Defend within the context of Schrems II, because it was not particularly requested to contemplate this query, the CJEU determined to look at and rule on the validity of the framework. Find the Privateness Defend invalid, the CJEU took the view that “the restrictions on the safety of private information arising from [U.S. domestic law] on the entry and use by U.S. public authorities […] aren’t circumscribed in a manner that satisfies necessities which can be basically equal to these required beneath EU regulation, by the precept of proportionality, in as far as the surveillance programmes based mostly on these provisions aren’t restricted to what’s strictly mandatory.” The CJEU additionally discovered that the EU-U.S. Privateness Defend framework doesn’t grant EU people actionable rights earlier than the courts towards the US authorities.
Placing it Into Observe: Corporations who have interaction in transfers of private data from the EU to the US will wish to have a look at the premise on which they have interaction in that switch. For these US firms who’re Privateness Defend contributors, remember the fact that though the EU has “invalidated” this system from the EU perspective, this system is a US-run one and nonetheless exists. We thus anticipate route coming quickly from the Division of Commerce concerning how you can tackle participation and reference present Defend participation. Within the meantime, adjustments within the foundation for switch will have to be made (comparable to customary contractual clauses). We additionally anticipate, nonetheless, modifications to the usual contractual clause regime, and can be watching these developments intently. Given the EU’s concern round disclosures to the US authorities, firms might also wish to overview this side of their insurance policies, procedures and information safety agreements.
Copyright © 2020, Sheppard Mullin Richter & Hampton LLP.Nationwide Legislation Overview, Quantity X, Quantity 198