EU Court of Justice · 16 July 2020
Schrems II
In plain English
The Court declared the EU-US Privacy Shield invalid because of US surveillance law. Standard contractual clauses remain valid, but data sent abroad under them must get protection essentially equivalent to EU law, and regulators must stop transfers where it does not.
What the court ruled
Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield is invalid.
the appropriate safeguards, enforceable rights and effective legal remedies required by those provisions must ensure that data subjects whose personal data are transferred to a third country pursuant to standard data protection clauses are afforded a level of protection essentially equivalent to that guaranteed within the European Union …
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the court’s own records is authoritative. The plain-English line is Fino’s own summary, not legal advice.