## Facts

- Maximillian Schrems, an Austrian Facebook user, complained that Facebook Ireland transferred EU users’ personal data to the United States for processing by Facebook Inc.
- Facebook Ireland relied on the European Commission’s Safe Harbour adequacy decision (Decision 2000/520/EC) as the legal basis for those transfers under Directive 95/46/EC.
- Following disclosures about U.S. intelligence programs, Schrems asserted that U.S. law permitted broad government access to transferred data, undermining adequate protection and effective remedies for EU data subjects.
- Schrems asked the Irish Data Protection Commissioner (DPC) to suspend or prohibit the transfers; the DPC declined to investigate, reasoning it was bound by the Commission’s adequacy decision.
- Schrems sought judicial review; the Irish High Court referred questions to the Court of Justice of the European Union (CJEU) concerning (i) the DPC’s powers when an adequacy decision exists and (ii) the validity of the Safe Harbour decision under the EU Charter.
- Digital Rights Ireland participated as a joined party in the preliminary reference proceedings.

## Issues

1. Whether a Commission adequacy decision under Directive 95/46/EC prevents a national supervisory authority from independently investigating a complaint alleging that transfers to a third country fail to provide adequate protection, and from taking steps to suspend transfers.
2. Whether the Safe Harbour adequacy decision (Decision 2000/520/EC) was valid in light of EU fundamental rights to privacy, data protection, and effective judicial protection.

## Decision

- The CJEU held that national supervisory authorities retain independent authority to examine complaints about international transfers, even where a Commission adequacy decision exists.
- The CJEU clarified that while supervisory authorities must respect binding EU acts, only the CJEU may declare an EU act invalid; where doubts arise, authorities must enable judicial review leading to a validity reference.
- The CJEU declared the Safe Harbour adequacy decision invalid.
- The Court found the Safe Harbour framework permitted U.S. public-authority access to data to prevail over privacy principles without sufficient limits or objective criteria.
- The Court determined that broad, indiscriminate access to communications content and the absence of effective redress for EU data subjects were incompatible with fundamental rights protections required for adequacy.
- The matter returned to the referring court with the instruction that the DPC must examine Schrems’s complaint under EU law absent a valid adequacy decision.

## Legal Principles

- “Adequate level of protection” for third-country transfers requires protection that is essentially equivalent, in substance and effectiveness, to EU guarantees as informed by fundamental rights.
- National supervisory authorities must act with complete independence and cannot be stripped of their investigative role by a Commission adequacy decision.
- Individuals must be able to lodge transfer-related complaints with supervisory authorities notwithstanding the existence of an adequacy decision.
- Only the CJEU can invalidate EU legal acts; supervisory authorities that identify serious doubts must channel the issue to national courts for a preliminary ruling on validity.
- An adequacy decision must account for third-country limitations on privacy and data-protection rights and must ensure meaningful, accessible remedies for affected individuals.
- Legal regimes permitting generalized access to data content without strict necessity, proportionality, and effective remedies fail to satisfy fundamental rights requirements for international transfers.

## Conclusion

The CJEU invalidated the EU–U.S. Safe Harbour adequacy decision and confirmed that national data protection authorities must independently investigate complaints about international transfers and facilitate judicial review when the validity of an EU adequacy decision is in question.


Schrems v. Data Prot. Comm’r, Case C-362/14 (C.J.E.U. 2015)