Schrems II
The 16 July 2020 judgment of the Court of Justice of the EU (Case C-311/18) that invalidated the EU–US Privacy Shield and required case-by-case checks when relying on standard contractual clauses.
The Court held that US surveillance law did not give protection essentially equivalent to EU law, so the Privacy Shield adequacy decision was invalid. It kept the standard contractual clauses valid, but said exporters must verify, case by case, whether the destination country’s law allows the clauses to be respected, and add supplementary measures or suspend the transfer if it does not.
Transfer impact assessments followed from it, and in 2023 so did the EU–US Data Privacy Framework.
Source: CJEU, Case C-311/18 ↗
Related terms
ClauseTrail watches vendors' subprocessor lists, DPAs, privacy policies, terms and AI terms, and tells your team what changed and by when to object.