# Data Protection Commissioner v Facebook Ireland and Maximillian Schrems - Type: Case Law - Source: CJEU - Identifier: C-311/18 - Date: 2020-07-16 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=51470 - Canonical: https://overview.legal/posts/51470 - Topics: Personal Data, Controllers, Data Portability, Notification Obligation, Privacy Shield, Processors, Certification, Codes of Conduct, Accountability, Privacy by Design & Default ## Summary Invalidated Privacy Shield adequacy decision and upheld validity of Standard Contractual Clauses with additional safeguards required. ## Sections (9) ### ¶64 In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board.’ > Topics: Supervisory Authorities, Supervision ### ¶23 Article 78 of the GDPR, under the heading ‘Right to an effective judicial remedy against a supervisory authority’, provides, in paragraphs 1 and 2: ‘1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. > Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-78-en ### ¶24 Article 94 of the GDPR provides: ‘1. Directive [95/46] is repealed with effect from > Applies: gdpr-art-94-en ### ¶25 May 2018.’ The SCC Decision ### ¶26 Recital 11 of the SCC Decision reads as follows: ‘Supervisory authorities of the Member States play a key role in this contractual mechanism in ensuring that personal data are adequately protected after the transfer. In exceptional cases where data exporters refuse or are unable to instruct the data importer properly, with an imminent risk of grave harm to the data subjects, the standard contractual clauses should allow the supervisory authorities to audit data importers and sub-processors and, where appropriate, take decisions which are binding on data importers and sub-processors. The supervisory authorities should have the power to prohibit or suspend a data transfer or a set of transfers based on the standard contractual clauses in those exceptional cases where it is established that a transfer on contractual basis is likely to have a substantial adverse effect on the warranties and obligations providing adequate protection for the data subject.’ > Topics: International Transfer, Supervision, Personal Data ### ¶27 Article 1 of the SCC Decision states: ‘The standard contractual clauses set out in the Annex are considered as offering adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights as required by Article 26(2) of Directive [95/46].’ > Topics: International Transfer · Applies: gdpr-art-26-par-2-en, gdpr-art-1-en ### ¶28 In accordance with the second paragraph of Article 2 of the SCC Decision, that decision ‘shall apply to the transfer of personal data by controllers established in the European Union to recipients established outside the territory of the European Union who act only as data processors’. > Topics: Personal Data · Applies: gdpr-art-2-en ### ¶29 Article 3 of the SCC Decision provides: ‘For the purposes of this Decision, the following definitions shall apply: … (c) “data exporter” means the controller who transfers the personal data; (d) “data importer” means the processor established in a third country who agrees to receive from the data exporter personal data intended for processing on the data exporter’s behalf after the transfer in accordance with his instructions and the terms of this Decision and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of Directive [95/46]; … (f) “applicable data protection law” means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established; …’ > Topics: Data Controller, Processors, Personal Data, Processing · Applies: gdpr-art-25-par-1-en, gdpr-art-3-en ### ¶30 According to its original wording, prior to the entry into force of Implementing Decision 2016/2297, Article 4 of Decision 2010/8 > Applies: gdpr-art-4-en ## Cited law provisions (44) ### GDPR — gdpr-art-2-par-1-en This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. ### GDPR — gdpr-art-2-par-2-en This Regulation does not apply to the processing of personal data: ### GDPR — gdpr-art-3-par-2-en This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: ### GDPR — gdpr-art-4-par-2-en ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ### GDPR — gdpr-art-25-par-1-en Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. ### GDPR — gdpr-art-25-par-2-en The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons. ### GDPR — gdpr-art-26-par-2-en The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject. ### GDPR — gdpr-art-28-par-3-en Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: ### GDPR — gdpr-art-45-par-3-en The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). ### GDPR — gdpr-art-51-par-1-en Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’). ### GDPR — gdpr-art-55-par-1-en Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State. ### GDPR — gdpr-art-57-par-1-en Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: ### GDPR — gdpr-art-58-par-2-en Each supervisory authority shall have all of the following corrective powers: ### GDPR — gdpr-art-64-par-1-en The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it: ### GDPR — gdpr-art-64-par-2-en Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62. ### GDPR — gdpr-art-65-par-1-en In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases: ### GDPR — gdpr-art-93-par-2-en Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. ### GDPR — gdpr-art-1-en Subject-matter and objectives ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-3-en Territorial scope ### GDPR — gdpr-art-4-en For the purposes of this Regulation: ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-20-en Right to data portability ### GDPR — gdpr-art-23-en Restrictions ### GDPR — gdpr-art-25-en Data protection by design and by default ### GDPR — gdpr-art-29-en The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law. ### GDPR — gdpr-art-30-en Records of processing activities ### GDPR — gdpr-art-31-en The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks. ### GDPR — gdpr-art-34-en Communication of a personal data breach to the data subject ### GDPR — gdpr-art-40-en Codes of conduct ### GDPR — gdpr-art-42-en Certification ### GDPR — gdpr-art-44-en Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined. ### GDPR — gdpr-art-45-en Transfers on the basis of an adequacy decision ### GDPR — gdpr-art-46-en Transfers subject to appropriate safeguards ### GDPR — gdpr-art-47-en Binding corporate rules ### GDPR — gdpr-art-49-en Derogations for specific situations ### GDPR — gdpr-art-58-en Powers ### GDPR — gdpr-art-61-en Mutual assistance ### GDPR — gdpr-art-62-en Joint operations of supervisory authorities ### GDPR — gdpr-art-64-en Opinion of the Board ### GDPR — gdpr-art-77-en Right to lodge a complaint with a supervisory authority ### GDPR — gdpr-art-78-en Right to an effective judicial remedy against a supervisory authority ### GDPR — gdpr-art-94-en Repeal of Directive 95/46/EC ### GDPR — gdpr-art-99-en Entry into force and application --- Generated by overview.legal · https://overview.legal/posts/51470 · 2026-08-22