FAQs on the CJEU case

The CJEU received eleven questions submitted by the Irish High Court. The CJEU was free to reformulate the questions and address only some of them. This FAQ gives a simple overview of the judgment and the questions answered. It addresses the most relevant questions that people and companies may have about the CJEU’s judgment. (I) Scope of the case Which EU-US data transfers are not affected by this case? In simple terms: “Necessary” transfers of personal data are not affected. This case mainly concerns the voluntary “outsourcing” of processing of personal data to the United States. The case does not concern: (1) data that is not “personal data”; and (2) “necessary” data transfers to the United States (e.g. emails to the US, bookings in the US etc.) - in most cases these transfers benefit from a “waiver” provided in Article 49 of the GDPR. Therefore, this case does not mean that one cannot send emails or messages from the EU to the US. Any claim that suggests this is simply incorrect. D