What the court decided
On 16 July 2020 the Court of Justice of the European Union decided Case C-311/18, known as Schrems II after the Austrian privacy activist Maximilian Schrems who brought the complaint. The court:
- declared the Commission’s Privacy Shield adequacy decision (Decision (EU) 2016/1250) invalid;
- held that standard contractual clauses remain valid in principle;
- but required data exporters to check, case by case, whether the law of the recipient country ensures a level of protection essentially equivalent to that in the EU – and to add supplementary measures or stop the transfer if it does not.
Why the Privacy Shield fell
The court found that US surveillance programmes were not limited to what is strictly necessary and that EU citizens had no effective legal remedy before an independent body. The ombudsperson mechanism of the Privacy Shield did not meet that standard.
It was the second time the court struck down an EU-US arrangement: in 2015, Schrems I (Case C-362/14) had invalidated the Safe Harbour decision.
What it means today
Since Schrems II, organisations document transfer impact assessments for third-country transfers. The European Data Protection Board published recommendations on supplementary measures in 2021.
On 10 July 2023 the European Commission adopted a new adequacy decision for the EU-US Data Privacy Framework. It covers only US organisations certified under it; for others, standard contractual clauses and the Schrems II checks still apply.
This page is general information, not legal advice.
Frequently asked questions
Is the Schrems II judgment still relevant after the Data Privacy Framework?
Yes. Its requirements still apply to every transfer that is not covered by an adequacy decision, for example to US recipients not certified under the framework or to other third countries.
Did Schrems II ban data transfers to the USA?
No. It invalidated one transfer mechanism, the Privacy Shield, and made transfers based on standard contractual clauses subject to a case-by-case assessment.