The Advocate General has issued an Opinion which states that the European Commission’s decision, enforcing the Standard Contractual Clauses (SCCs), is valid.

The General Data Protection Regulation (GDPR) restricts transfers outside of the European Economic Area (EEA) to third countries (for example, the United States), unless an appropriate safeguard (recognised under the GDPR) has been put in place. An example of an appropriate safeguard is the SCCs, issued by the European Commission, which controllers based in the EEA can put in place with recipients based outside the EEA to legitimise data transfers. The case of Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Case C‑311/18) concerns the validity of the SCCs (another appropriate safeguard for transfers from the EEA to the US is certification to the EU-U.S. Privacy Shield Framework which is the subject of a separate legal challenge by Mr. Schrems).

Facebook Ireland relied on the SCCs to legitimise transfers to its parent company in the United States. Mr Schrems challenged the company’s reliance on the SCCs as he alleged there is no remedy that would allow individuals to invoke their right to respect for private life and to the protection of personal data in the United States. The Irish Data Protection Commissioner brought proceedings before the High Court in Ireland requesting it to refer the question to the Court of Justice of the EU.

The Advocate General has disagreed with Mr. Schrems’ challenge, stating that the SCCs are still valid. In particular, he has concluded that the fact the SCCs are not binding on the authorities of the third country and therefore do not prevent them from imposing obligations that are contrary to the requirements of those clauses on the recipient company, does not in itself render the SCCs invalid. The Advocate General found that the SCCs are valid because: (i) the contractual commitments of the parties to them are aimed at ensuring adequate protection for the personal data; and (ii) there is an obligation on the controller and the authorities to suspend or prohibit a transfer when the clauses cannot be complied with.

This is a landmark case as the SCCs are relied on by many EEA-based companies that transfer their personal data outside the EEA, and have no other practical means of transferring such data. Suffice it to say, a decision which renders these SCCs invalid would cause a major disruption to many data flows from the EEA.

Note, that the Advocate General’s Opinion is not binding on the Court of Justice. The role of the Advocates General is to propose a solution, but the Court of Justice rarely departs from the Advocate General’s opinion so this is a strong indication that the SCCs will survive. Judgment will be given at a later date – so we will be keeping a close eye on the conclusion of this case.