[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLayeFpnBs3VfAoatGW9oVpX9ZDpNqHUL1SYUbtRx6Qc":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":53},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"9135b2ce-af81-46ec-a243-263b4d1c495e","CJEU - C-311\u002F18 - Facebook Ireland and Schrems","cjeu-c-311-18-facebook-ireland-and-schrems-2f7a32","Fixed categorisation ← Older revision Revision as of 07:42, 16 September 2026 Line 51: Line 51: ==Further Resources== ==Further Resources== ''Share blogs or news articles here!'' ''Share blogs or news articles here!'' [[index.php?title=Category:Featured decisions]] [[Category:Featured decisions]]","The Court of Justice of the European Union (CJEU) invalidated Commission Decision 2016\u002F1250, commonly known as the EU-US Privacy Shield. However, the court affirmed the validity of Standard Contractual Clauses (SCCs) for data transfers, provided they include effective mechanisms to ensure compliance with the GDPR's level of protection for EU citizens.","CJEU invalidates EU-US Privacy Shield, upholds SCCs with conditions.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-311\u002F18_-_Facebook_Ireland_and_Schrems&diff=53080&oldid=52401","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-09-16T07:42:49+00:00","2026-09-16T08:00:14.726099+00:00",9,[17,20,23],{"name":18,"type":19},"Facebook","vendor",{"name":21,"type":22},"EU-US Privacy Shield","product",{"name":24,"type":22},"Standard Contractual Clauses","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":25,"icon":27,"name":28,"slug":29},null,"Privacy Fines","privacy-fines",[31,36,41,46],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":47},{"id":25,"icon":27,"name":28,"slug":29},[],[18,21,24],{"controls":51,"vendors":52},[],[],{"slug":54,"title":55,"body":56,"framework_refs":57,"framework_notes":68},"cjeu-strikes-down-eu-us-privacy-shield-validating-sccs-with-conditions","CJEU Strikes Down EU-US Privacy Shield, Validating SCCs with Conditions","The CJEU's Schrems II ruling invalidated the EU-US Privacy Shield framework, finding that US surveillance laws (e.g., FISA Section 702) do not provide equivalent protection to EU data subjects as required by GDPR. This ruling exposed thousands of organizations that relied solely on Privacy Shield as their legal transfer mechanism, leaving them temporarily without a valid basis for transatlantic data flows. The court's conditional validation of Standard Contractual Clauses (SCCs) underscores that legal instruments alone are insufficient — organizations must conduct Transfer Impact Assessments (TIAs) to verify real-world protection levels. This matters because non-compliant international data transfers can result in significant fines, enforcement actions, and reputational damage under GDPR.",[58,59,60,61,62,63,64,65,66,67],"GDPR Article 46 – Transfers subject to appropriate safeguards","GDPR Article 49 – Derogations for specific situations","GDPR Article 30 – Records of processing activities","EDPB Recommendations 01\u002F2020 on supplementary transfer measures","EDPB Recommendations 02\u002F2020 on the European Essential Guarantees","NIST Privacy Framework PR.DS-P5 – Data Processing Policies","NIST SP 800-53 PT-7 – Specific Categories of Personally Identifiable Information","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","CIS Control 3 – Data Protection","ITIL Service Management – Compliance and Risk Management",{}]