EC standard contractual clauses to be examined by CJEU

Irish High Court to make references to the CJEU

What’s the development?

Max Schrems has won another victory as the Irish High Court decides to make references to the CJEU around the validity of adequacy decisions which allow the use of EC standard contractual clauses (the SCC Decisions) as a lawful basis for personal data transfers between the EU and the USA. This puts standard contractual clauses (also known as model clauses) at risk of ceasing to be a lawful data transfer tool for EU-US data flows. The degree of risk will no doubt become clearer as we digest the judgment and learn exactly what will be referred to the CJEU.

What’s the issue?

After the first Schrems v Facebook complaint resulted in the CJEU striking down Safe Harbor as a data transfer mechanism between the EU and the US, it became clear that much of the CJEU’s reasoning might also be applied to other EU-US data transfer mechanisms.

The specific concern cited by the Irish Data Protection Commissioner in the revised complaint, is that there is an absence of an effective remedy in US law compatible with Article 47 of the Charter of Fundamental Rights of the European Union (right to an effective remedy), for an EU citizen whose data is transferred to the US and accessed by US state agencies in a manner incompatible with Articles 7 and 8 of the Charter. It is contended that safeguards in the SCC Decisions do not address this.

The Irish High Court held that the Data Protection Commissioner had raised well-founded concerns which it shares and that there was no obligation to reject the application by reason of the adoption of the EU-US Privacy Shield Decision. The Court requires the CJEU to determine whether the exceptional discretionary power conferred on the Data Protection Commissioner by Article 28 of the Data Protection Directive to suspend or ban the transfer of data to a data importer in a third country on the basis of that country’s legal regime, is sufficient to secure the validity of the SCC Decisions. The exact questions to be referred will be decided after hearing further submissions.

What does this mean for you?

If you rely on standard contractual clauses to transfer personal data between the EU and the USA, the outcome of this reference may be highly significant and it’s true that the CJEU has form in taking bold action in this area. Having said that, question marks around data transfers to the USA are not new and, for now, we need to keep a watching brief on developments, not only in terms of the exact questions referred to the CJEU on model clauses, but also the upcoming report on the first annual review of the Privacy Shield.