The Court of Justice of the European Union (ECJ) has announced that it will deliver its judgment in what has become known as the Schrems II case (Case 311/18 Facebook Ireland and Schrems) on 16th July 2020. The judgment will determine the validity of the Standard Contractual Clauses (or Model Clauses) (SCCs) as a transfer mechanism under the GDPR. This case arose following a complaint from Max Schrems, a lawyer and data privacy campaigner to the Irish Data Protection Commissioner (DPA) about transfers of his personal data from Facebook Ireland to Facebook US using SCCs. Mr. Schrems’s position is that Facebook is violating the EU data protection laws by allowing US intelligence authorities to access his personal data. The DPA issued proceedings in the Irish High Court in relation to the matter, which were stayed in 2018, with various questions raised by the DPC relating to SCC referred to the ECJ for determination.

You may recall that Max Schrems previously challenged the EU-US Safe Harbor arrangement (Schrems I case) which resulted in the ECJ declaring the EU-US Safe Harbor arrangement invalid. This caused consternation amongst businesses which had relied on the EU-US Safe Harbor for transfers of personal data across the Atlantic and had EU and US regulators scrambling for a replacement scheme until the EU-US Privacy Shield was put in place. The outcome of Schrems II is likely to have an even bigger impact if the SCCs are declared invalid, as a significantly large number of businesses rely on SCCs as a valid mechanism for transfers of personal data from the EU/UK to the US.

It should be noted that the cornerstone of Mr. Schrems’ complaint is not the per se validity of the SCCs, but the use of that mechanism for transfers of data to the US on the basis that the US does not provide the same level of protection afforded by EU law for personal data and, in particular, concerns about subsequent processing by US intelligence authorities for national security purposes. This also brings into the question transfers of all personal data from the EU to the US, including the use of the EU-US Privacy Shield for such data transfers. The latter has also been challenged before the ECJ’s General Court (Case T-738/16 – La Quadrature du Net and Others and Commission), the hearing of which has been postponed until the ECJ makes its determination in the Schrems II case.

The questions the ECJ has to determine include whether the SCCs provide adequate level of protection for data transfers from the EU to third countries (i.e. are they valid mechanisms for such data transfers under EU law) and the level of protection afforded to personal data transferred pursuant to the EU-US Privacy Shield because of processing undertaken by US intelligence authorities.

Various stakeholders have already made their submissions and opinion to the ECJ, including the European Data Protection Board (EDPB), the governments of Ireland and France, the European Commission, US authorities, Mr. Schrems and most recently (on 19 December 2019) the Advocate General of the ECJ, Henrik Saugmandsgaard Øe (AG). Most of the stakeholders’ (including Mr. Schrems’) position is that SCC should not be invalidated. The EDPB and the AG in particular have argued that the SCCs validity is not dependent on the protections provided in a third country. Furthermore, under the GDPR regime, the parties to the SCCs and data protection supervisory authorities have responsibility to assess and determine whether the use of SCC in any particular situation is appropriate. In particular, in response to a complaint, supervisory authorities have to assess whether the use of SCCs in that situation provide continuity of protection afforded by GDPR, once the personal data has been transferred. Supervisory authorities, when carrying out such assessments, also have to “ensure a fair balance between, on the one hand, observance of the fundamental right to privacy and, on the other hand, the interests requiring free movement of personal data”, and recital 4 of the GDPR”[1].

Parties to the SCCs take the responsibility for providing appropriate safeguards, such as the existence of data subject rights, the obligations of the exporter and the importer to ensure compliance with EU data protection laws. While supervisory authorities are only empowered to assess individual cases and do not have the power to issue a general restriction on transfers to a specific third country under the SCC regime, any decision on a specific case to suspend data transfers to the US will invariably require parties to assess whether they can comply with their obligations under SCCs and, therefore, whether SCCs are an appropriate safeguard to use when transferring personal data to the US.

The AG, in its opinion to the ECJ, has confirmed the validity of the SCC and supported the adequacy decision which supports the EU-US Privacy Shield. While the ECJ is not bound by the AG’s opinion, it is likely (and we hope) that the ECJ’s decision will be as close to the position taken by the AG. Even if this is the case on 16 July 2020, it will not be the end of the saga in relation to the challenges facing data transfers from the EU/UK to the US. The issue will only get pushed to individual supervisory authorities who will have to make determinations in individual cases which may result in supervisory authorities taking different positions vis-a vis transfers to the US (when one of the aims of GDPR was to bring uniformity across the EU in implementation and approach to data transfers). Businesses relying on SCCs will inevitably have to assess all the circumstances of the intended personal data transfers to ensure that they are in a position to comply with their obligations, including positions taken by all relevant EU/UK data protection supervisory authorities in the countries in which they have operations. An uncertain and an uneven regulatory landscape for trade related data transfers across the Atlantic in an already turbulent period will only expose businesses to additional risks and associated costs and hinder trade. One does not even want to begin contemplating the consequences of an ECJ decision invalidating the SCCs.

[1] EDPB in its pleadings to the ECJ in the Schrems II case.