Advocate General issues opinion in Schrems II
The Advocate General of the European Court of Justice (“ECJ”) has recommended that the court upholds the validity of the controller-to-processor Standard Contractual Clauses in the case of Data Protection Commissioner v Facebook Ireland Limited (commonly referred to as Schrems II).
Background and facts
The case concerns the Austrian privacy activist, Max Schrems, and the transfer of his personal data by Facebook from Ireland to the US. In an earlier decision involving Schrems and Facebook, the ECJ invalidated the EU-US “Safe Harbor” transfer mechanism (which then led to the EU-US “Privacy Shield” framework being implemented as a replacement for the Safe Harbor scheme).
At a very high level, Schrems’ complaint in the present case is that Facebook should not be allowed to rely upon the Standard Contractual Clauses to transfer his personal data to the US since these do not adequately protect his personal data once transferred due to the wide-reaching surveillance powers provided to US governmental organisations.
Although the case relates specifically to transfers by Facebook to the US, one potential outcome of the case was that the Standard Contractual Clauses would be invalidated. This would have broad implications for a large number of businesses which currently rely upon Standard Contractual Clauses as a convenient mechanism to transfer personal data outside the European Economic Area.
Advocate General’s Opinion
Given the opinion of the Advocate General, which is not binding on the ECJ but which is followed in around 80% of cases, it seems unlikely that such an outcome will materialise.
The key points to note from the Advocate General’s opinion are as follows:
Other points
It is to be expected that the EU Commission will issue updated controller-to-processor Standard Contractual Clauses in the not-too-distant future. The consensus is that they are outdated and in need of a refresh to reflect the requirements of the GDPR.
Conclusion
The Advocate General’s opinion will come as welcome news to the numerous businesses which currently rely upon Standard Contractual Clauses. The opinion highlights, however, that businesses should in practice be reviewing compliance with such clauses and not simply treating the implementation of the contracts as a tick-box exercise.
The above is of course subject to change based on the final decision of the ECJ in this case, expected early 2020. We will be watching out for this and will update you once we are in a position to do so.
You can register online or follow us on Twitter or LinkedIn to receive our latest news, events and publications.