Macchi di Cellere Gangemi
European Union:
The Birth in Schrems Vs. Facebook Ireland Dated 16 July 2020 (C-311/18) And Transfer of Personal Data from the European Union to the United States of America: Have you complied with the new requirements?
To print this article, all you have to do is register or log on to Mondaq.com.
On 16 July 2020, the European Court of Justice (“ECJ”) ruled that the “eligibility decision” was invalid as regards the level of protection in the processing of personal data when data are transferred from the European Union ( “EU”) to the United States of America (“USA”), also known as the “Privacy Shield” and adopted by the European Commission in 2016.
In particular, the Court found that U.S. law does not comply with the principle of equal protection required under EU rules, as US public authorities can access the personal data transferred, without restrictions. specifically, for reasons related to internal security.
Schrems II ‘s judgment now establishes that European companies moving personal data to the US will now reassess this trend as a result of the new signals implemented by the ECJ. In particular, the validity of the standard contractual clauses has been confirmed, noting, however, that a level of protection must be guaranteed, subject to confirmation, which is substantially equivalent to that guaranteed in the EU by a Protection Regulation. General Data 2016/679 (“GDPR”).
In other words, companies may be able to use the standard contractual clauses only once compliance with GDPR data transfer provisions has been verified.
The European Data Protection Board (“EDPB”) has rapidly developed guidelines, providing helpful advice and clarifying specific aspects of that judgment. For example, it is specified that it is possible to use the exceptions provided in Art. 49 of the GDPR, including whether the motion was based on consent or for the execution of a contract.
The impact of this regulation is extremely significant. Indeed, so far, any move to the US is illegal unless it is assessed in accordance with the new principles set forth by the ECJ through the Schrems II rule.
With the ECJ ‘s definition of data transfers to the US, have you already proven that you comply with EU law?
First published 26/10/2020
The content of this article is intended to provide general guidance on the subject. Specialist advice should be sought about your particular circumstances.
ARTICLES POPULAR ON: Privacy from the European Union