What you need to know.
On 19 December 2019, Advocate General at the Court of Justice Saugmandsgaard Øe confirmed the validity of the standard contractual clauses for the international transfer of personal data ("the Schrems II case"). Following a complaint by privacy activist Max Schrems, the Advocate General issued his opinion. Schrems believes that the transfer of his personal data from Facebook Ireland to Facebook Inc. in the USA, on the basis of the standard contractual clauses, does not provide adequate safeguards for the protection of his personal data.
What is this about? Transferring personal data to other companies entails certain obligations (for more information on these obligations see GDPR toolkit - transfer). A transfer of personal data outside the EEA is in principle prohibited, unless the company can rely on one of the transfer mechanisms provided by the GDPR: adequacy decisions, standard contractual clauses, binding corporate rules, etc. These mechanisms should essentially ensure that the personal data of European citizens enjoy the same protection outside the EEA as under the GDPR.
Practical experience has shown that companies rely, to a large extent, on the standard contractual clauses for international data transfers. The complaint by privacy activist Schrems calls that mechanism into question. Ultimately, the Court of Justice can still render another judgment. Moreover, the current standard contractual clauses were drawn up by the European Commission under the old legislation and are therefore currently being revised.
What you need to do.
Insofar as this has not yet been done, this is the perfect time for your company to identify and evaluate all transfers of personal data outside the EEA. This is also an important element in the preparations for the Brexit.
Based on the location of the 'receiving' companies, your company can check whether an adequacy decision is available for that specific country. In such a case your company does not have to do anything else. If such an adequacy decision is not available, you should check whether you can rely on one of the appropriate safeguards, including, for example, the standard contractual clauses, or one of the grounds for exception.
If your company makes use of standard contractual clauses, there is no reason for alarm at this point in time. In his opinion, the Advocate General confirmed the validity of the standard contractual clauses. However, it remains to be seen whether the Court of Justice will follow the Advocate General in this respect - the judgment is expected in the first quarter of 2020 - and when the European Commission will issue new standard contractual clauses. We'll keep you posted!
