CJEU - C-311/18 - Facebook Ireland and Schrems
CJEU invalidates EU-US Privacy Shield but upholds Standard Contractual Clauses for transatlantic data transfers.
In the landmark Schrems II decision (C-311/18), the Court of Justice of the European Union invalidated the EU-US Privacy Shield adequacy decision due to mass surveillance under US law (FISA Section 702, PRISM, UPSTREAM, Executive Order 12.333), finding it incompatible with GDPR protections. However, the court affirmed the validity of Standard Contractual Clauses (SCCs) as a lawful transfer mechanism, provided they include effective safeguards ensuring essentially equivalent data protection. The ruling underscores that supervisory authorities must diligently handle data subject complaints and that third-country surveillance regimes may render contractual clauses insufficient without additional protective measures.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Meta (Facebook)?
Get an email when a new story names Meta (Facebook), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU's Schrems II ruling invalidated the EU-US Privacy Shield framework because US surveillance laws (FISA Section 702, EO 12.333) allowed broad government access to EU personal data without adequate redress mechanisms, failing the 'essentially equivalent' protection standard required by GDPR. This ruling exposed a critical flaw in relying on political adequacy decisions without independently verifying that recipient countries provide enforceable data subject rights. Organizations that had been transferring EU personal data to the US under Privacy Shield were suddenly operating without a lawful transfer mechanism. The decision highlights that contractual safeguards alone (SCCs) may be insufficient when a third country's surveillance laws structurally undermine data protection, requiring additional technical and organizational measures such as encryption or pseudonymization.