31 July

CIVILE E COMMERCIALE

Privacy Shield: EDPB FAQs are online after the Schrems II judgement of the Court of Justice

31/07/2020

The EDPB (European Data Protection Board) has published the document "Frequently Asked Questions on the judgement of the Court of Justice of the European Union in Case C-311/18 – Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems" online (edpb.europa.eu) in order to answer to frequently asked questions received by the supervisory authorities on the judgement of 16 July 2020 (in case C-311/18, so-called "Schrems II"), with which the Court of Justice declared the invalidity of the Privacy Shield (Implementing Decision of the European Commission 2016/1250), on which the lawfulness of the transfers of personal data from Europe to the United States was based to date.

For the Court of Justice, US legislation does not guarantee a level of protection deemed substantially equivalent to that guaranteed within the Union, since it offers to public authorities, in implementation of surveillance programs, access to personal data transferred from the EU to the United States, without granting data subjects rights actionable in the courts against the US authorities. While confirming the validity of European Commission Decision 2010/87 on standard contractual clauses, the Court of Justice established that before any transfer of personal data to a third country takes place on the basis of these clauses, it is necessary for an assessment to be performed of the level of protection guaranteed by the country of destination.

With the aforementioned document, the EDPB provides clarifications on that decided by the Court of Justice in the Schrems II case, specifying that any transfer of personal data to the United States carried out on the basis of the Privacy Shield must be considered illegal, and transfers based on standard contractual clauses or binding corporate rules can be done only after a case-by-case analysis. However, transfers to third countries other than the United States may be made on the basis of standard contractual clauses or binding corporate rules, provided that the preliminary assessments established by the Court of Justice are carried out and supplementary measures are identified, where necessary.