DPC v. Facebook Ireland Limited & Schrems - July 2020
Record No.
C-311/18
Type of action and Venue
Preliminary reference from the Irish High Court, CJEU
Date of Judgment Order
16 July 2020 (Written judgment)
Outcome
The Court of Justice of the European Union delivered judgment on 16 July 2020, in which it addressed 11 questions posed by the Irish High Court in the context of a preliminary reference made on 4 May 2018.
In summary, the CJEU upheld the validity of a decision of the EU Commission incorporating the “standard contractual clauses” mechanism by which personal data may be lawfully transferred from the EU/EEA to a third country in respect of which an adequacy decision has not been adopted by the EU Commission.
Importantly, the CJEU went on to clarify the nature and extent of the obligations to which data exporters and supervisory authorities are subject in any case where SCCs are relied on to justify data transfers to a third county, with a view to ensuring that, in terms of appropriate safeguards, enforceable rights and effective legal remedies, data subjects whose personal data are transferred to a third country are afforded a level of protection essentially equivalent to that guaranteed within the EU by the GDPR, read in the light of the Charter.
Having made certain findings of general application relating to the adequacy of the protection provided to EU citizens in the United States, the CJEU also ruled that the EU Commission’s decision adopting the “Privacy Shield” arrangements for data transfers to US was invalid.
Note that the issue of costs in the underlying proceedings was the subject of a separate ruling by the High Court made on 28 October 2020, referred to at item 12 below.
Current Status of Case
Proceedings complete.
A series of explanatory memoranda for this case can be accessed here.