Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems

1 Statement on the Court of Justice of the European Union Judgment in Case C - 311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems Adopted on 17 July 2020 The European Data Protection Board has adopted the following statement: The EDPB welcomes the CJEU’s judgment, which highlights the fundamental right to privacy in the context of the transfer of personal data to third countries. The CJEU’s decision is one of great importance. The European Data Protection Board (EDPB) has taken note of the fact that the Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU - US Privacy Shield, and of the fact that it considers Commission Decision 2010/87 on Standard Contractual Clauses (SCCs) for the transfer of personal data to processors establ ished in third countries valid. The EDPB discussed the Court’s ruling during its 34 th p lenary session of 17 July 2020.

S. S. is essentially equivalent to that guaranteed within the EU, in line with the judgment. The EDPB identified in the past some of the main fl aws of the Privacy Shield on which the CJEU grounds its decision to declare it invalid. S. law 1 . S. S. , a new framework that fully complies with EU data protection law. While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essen tially equivalent to the one guaranteed by the GDPR in light of the EU Charter . The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whet her to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime a pplicable in the importer’s country.

The examination of the latter shall be done in light of the non - exhaustive factors set out under Art 45(2) GDPR. If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking f urther into what these additi onal measures could consist of. The CJEU’s judgment also recalls the importance for the exporter and importer to comply with their obligations included in the SCCs, in particular the information obligations in relation to chang e of legislation in the importer’s country. When those contractual obligations are not or cannot be complied with, the exporter is bound by the SCCs to suspend the transfer or terminate the SCCs or to notify its competent supervisory authority if it intend s to continue transferring data.

The EDPB takes note of the duties for the competent supervisory authorities (SAs) to suspend or prohibit a transfer of data to a third country pursuant to SCCs, if, in the view of the competent SA and in the light of all th e circumstances of that transfer, those clauses are not or cannot be complied with in that third country, and the protection of the data transferred cannot be ensured by other means, in particular where the controller or a processor has not already itself suspended or put an end to the transfer. The EDPB recalls that it issued guidelines on Art 49 GDPR derogations 2 ; and that such derogations must be applied on a case - by - case basis. The EDPB will assess the judgment in more detail and provide further clarifi cation for stakeholders and guidance on the use of instruments for the transfer of personal data to third coun tries pursuant to the judgment. The EDPB and its European SAs stand ready, as stated by the CJEU, to ensure consistency across the EEA. 3