## Facts

- Maximillian Schrems, an Austrian Facebook user, complained that Facebook Ireland transferred his personal data to the United States for processing by Facebook Inc.
- Facebook Ireland relied primarily on EU standard contractual clauses (SCCs) adopted by the European Commission (Decision 2010/87/EU) as the legal mechanism for these transfers.
- Schrems argued that U.S. surveillance laws permitted broad access by U.S. public authorities to transferred EU personal data and did not provide protections or remedies equivalent to those required under EU fundamental rights.
- The Irish Data Protection Commissioner (DPC), responsible for supervising GDPR compliance in Ireland, questioned whether SCC-based transfers to the United States could ensure the required level of protection in practice.
- The Irish High Court referred questions to the Court of Justice of the European Union (CJEU) for a preliminary ruling concerning (i) the validity and operation of SCCs and (ii) the validity of the EU–US Privacy Shield adequacy decision (Commission Implementing Decision 2016/1250).

## Issues

1. Whether transfers of personal data under SCCs require that, in practice, the third country provide a level of protection essentially equivalent to that guaranteed in the EU under the GDPR and the EU Charter.
2. Whether the Commission’s SCC decision (Decision 2010/87/EU) is valid given that contractual clauses cannot bind third-country public authorities.
3. What duties fall on data exporters, importers, and supervisory authorities when third-country law may prevent compliance with SCCs and EU fundamental-rights requirements.
4. Whether the EU–US Privacy Shield adequacy decision (Decision 2016/1250) is valid in light of EU Charter rights to privacy, data protection, and an effective remedy.

## Decision

- The CJEU upheld the validity of the Commission’s SCC decision (Decision 2010/87/EU).
- The CJEU held that reliance on SCCs requires assessing, for the specific transfer, whether the third-country legal order permits compliance with EU-level protections; where it does not, additional safeguards are required or transfers must be suspended.
- The CJEU invalidated the EU–US Privacy Shield adequacy decision (Decision 2016/1250).
- The CJEU clarified that supervisory authorities have a duty to suspend or prohibit a transfer when the SCCs cannot be complied with in the third country and no effective supplementary measures can ensure essentially equivalent protection.

## Legal Principles

- International transfers of EU personal data must ensure a level of protection essentially equivalent to that guaranteed by the GDPR as informed by EU Charter rights, including effective judicial protection.
- SCCs are not invalid merely because they cannot bind third-country public authorities; their use depends on whether the exporter/importer can ensure, in practice, effective protection for the transferred data.
- Data exporters and importers must evaluate third-country laws relevant to government access to data and implement supplementary measures where needed; if effective protection cannot be ensured, transfers must be halted.
- Supervisory authorities must take effective enforcement action—including suspension or prohibition of transfers—when required protections cannot be achieved for SCC-based transfers.
- An adequacy decision is invalid if third-country surveillance and redress arrangements do not satisfy EU requirements of necessity and proportionality and do not provide data subjects with an effective remedy.

## Conclusion

The CJEU sustained SCCs as a transfer tool but conditioned their lawful use on transfer-specific assessments and effective safeguards, while striking down the EU–US Privacy Shield because U.S. surveillance and redress mechanisms did not provide essentially equivalent protection or effective judicial remedies for EU data subjects.


Data Prot. Comm’r v. Facebook Ir. Ltd., Case C-311/18 (C.J.E.U. 2020)