Advocate General Gives Opinion On Schrems II: An Early Christmas Present?

Today, the Advocate General Henrik Saugmandsgaard Øe (AG) published his opinion on a case brought by privacy rights activist, Max Schrems (C-311/18, Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems) (Schrems II). The case concerns the validity of the standard contractual clauses (SCCs). The Court of Justice of the European Union (CJEU) press release can be found here, and the AG's opinion here.

The General Data Protection Regulation (GDPR) provides that personal data may be transferred to a third country if that country ensures an adequate level of data protection. SCCs are one of several mechanisms approved by the European Commission for personal data transfers to countries not found to offer adequate protection for personal data. If the SCCs were invalidated, thousands of businesses would have to review their data transfer arrangements.

Below, we take a look at the AG opinion.

Background

The background to the Schrems case is a complex one. The case is the continuation of an earlier complaint made by Schrems against Facebook in 2013. In 2013, Schrems filed a complaint with the Irish data protection authority claiming that Facebook's transfer of EU citizens' personal data under the Safe Harbor framework to Facebook in the U.S. violated their rights.

In a landmark finding in October 2015, the CJEU held that the Safe Harbor framework was invalid (Schrems I). We wrote about this decision here. Amongst other reasons, this decision was based on the fact that U.S. legislation did not limit the interference with an individual's rights to what is strictly necessary.

Since then, Schrems reformulated his complaint. Schrems decided to challenge the transfers to the US performed on the basis of the SCCs. The use of the SCCs was the alternative mechanism Facebook relied on to legitimize EU-U.S. data flows, as they could no longer rely on the Safe Harbor provisions following Schrems I. The Irish data protection authority brought the Schrems II proceedings before the Irish High Court who referred 11 questions for a preliminary ruling.

The key questions referred to the CJEU included:

Whether the use of SCCs for transfers of personal data to third countries offers sufficient safeguards as regards to the protection of those freedoms and fundamental rights Whether the laws and practices in third countries are relevant when considering whether SCCs can be relied on to legitimize transfers of personal data to third countries Whether...