On Dec. 19, the Court of Justice of the European Union's advocate general issued his 97-page opinion in the so-called "Schrems 2.0" case concerning the validity of two key data transfer mechanisms: standard contractual clauses and the EU-U.S. Privacy Shield framework — mechanisms widely used by businesses within the European Economic Area to legitimize the transfer of personal data to countries outside the EEA. It is now up to the judges of the CJEU to assess his opinion and come to a decision, hopefully before the 2020 Easter holidays.
5 key takeaways for businesses
1.) SCCs continue to be a valid mechanism to support the transfer of personal data to any country located outside the EEA.
2.) SCCs, in principle, establish safeguards in relation to a transfer that are sufficient to compensate for any inadequacy of the protection afforded in the destination country.
3.) Any data exporter looking to use SCCs has a responsibility to assess whether the law of the destination country may constitute an obstacle to the implementation of the SCCs.
4.) The advocate general does not want to take a formal decision on the validity of Privacy Shield.
5.) If the court, however, were to decide to examine the validity of the Privacy Shield, the advocate general raises “doubts” about its validity.
Impact on business
Takeaway 1: SCCs continue to be a valid mechanism to support the transfer of personal data to any country located outside the EEA (irrespective of the level of protection guaranteed there).
SCCs remain an alternative mechanism for transfer to countries that do not ensure a level of protection essentially equivalent to that imposed by EU law. Such a mechanism could be used irrespective of the third country of destination, and the level of protection that that third country offers provided that the lack of equivalent protection is being compensated by appropriate safeguards to ensure the continuity of the level of protection of personal data afforded under the EU General Data Protection Regulation.
The key element to take into account to assess whether the SCCs are valid by reference to the Charter of Fundamental Rights of the European Union is not the protection afforded by the third country of destination but the soundness of the safeguards put in place by the SCCs to compensate the deficiencies of the level of protection afforded in the third country of destination. Therefore, the fact that a third country of destination does not provide enforceable data subjects rights and effective legal remedies for data subjects is not relevant given that those are being provided by the SCCs. Consequently, the advocate general concluded that his “analysis has not revealed any element of such kind as to affect the validity of Decision 2010/87 by reference to Articles 7, 8 and 47 of the Charter.”
SCCs are currently the most popular mechanism for supporting transfers to countries that do not benefit from an adequacy decision, so it is welcome news that the advocate general believes SCCs may still be used as a valid transfer mechanism.
Takeaway 2: SCCs, in principle, establish safeguards in relation to a transfer, sufficient to compensate any inadequacy of the protection afforded in the destination country.
This aspect of the opinion is helpful in not only restating the validity of the SCCs as a mechanism for transferring personal data, but also giving businesses confidence they don’t need to undertake a full-scale assessment of the level of safeguards provided in the destination country.
As a matter of default, the SCCs provide safeguards against to compensate for any deficiencies in the level of protection otherwise afforded in the destination country. Therefore, the fact that a third country of destination does not provide enforceable data subjects rights and effective legal remedies for data subjects is not relevant given that those are being provided by the SCCs.
Takeaway 3: Any data exporter looking to use SCCs (and where relevant supervisory authorities that have oversight over the activities of data exporters) has a responsibility to assess whether the law of the destination country may constitute an obstacle to the implementation of the SCCs.
This aspect of the opinion raises an increased burden of accountability for companies. While the responsibility to assess whether transfers to a third country do not undermine the protection afforded under the GDPR falls on the European Commission for adequacy decisions, such responsibility is borne by the exporter and ultimately the SAs when transfers are based on SCCs.
The advocate general’s reasoning entails that companies will need to assess, on a case-by-case basis and prior to the transfer, whether transfer to a given country can be performed under the SCCs in light of the legal framework of the country of destination. This means that simply relying on SCCs as a basis for transferring data will not per se guarantee safeguards; the controller will have to undertake a wider assessment on the adequacy of a third country even when adopting SCCs.
This point is critical provided the advocate general goes further than what the SCCs actually provide. The SCCs do not require such a prior assessment of the legal framework of the third country of destination. The advocate general, therefore, increases the burden of accountability for companies.
Additionally, more pressure is being put on SAs, which are required to prohibit or suspend transfer to a third country where appropriate safeguards cannot be guaranteed. Moreover, the advocate general considered that a decision from a SA not to prohibit or suspend a transfer may be subject to judicial action. This may lead to higher levels of interference by SAs in the flexibility companies currently have to effectively transfer data anywhere in the world, with the potential "blacklisting" of certain countries in the future. This may also lead to a higher risk of fines. In this respect, infringing Article 46 of the GDPR could lead to administrative fines up to 20,000,000 euros, or, in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
Takeaway 4: The advocate general does not want to take a formal decision on the validity of Privacy Shield.
Businesses will be relieved the advocate general is unwilling to consider a decision on the validity of Privacy Shield. As a result, data transfers made under the protection of Privacy Shield remain valid, and there is no need to put in place any "repapering" to SCCs.
Bear in mind, however, that questions on the validity of Privacy Shield have not gone away as another case is pending on this issue and the court may still yet find challenges with the regime.
Takeaway 5: If the CJEU, however, were to decide to examine the validity of the Privacy Shield, the advocate general raises “doubts” about its validity.
Although businesses will be pleased the advocate general does not seek to formally invalidate Privacy Shield, the “observations” he makes suggest an underlying concern about underlying weaknesses in the validity of the European Commission’s original assessment regarding its adequacy.
It is clear the advocate general has doubts about Privacy Shield, and organizations should bear this in mind when thinking about relying on Privacy Shield as a transfer mechanism, as its days may well be numbered.
What's next?
The judges of the court are now starting their deliberations in this case. The CJEU’s judgment typically follows a further three to six months after the advocate general’s opinion, and although the opinion carries significant weight, the court is not bound to follow it and can (and sometimes does) adopt a different position.
We expect a decision to be taken still before the 2020 Easter holidays.
Photo by Bill Oxford on Unsplash
