According to the forthcoming 2017 IAPP-EY Privacy Governance Survey, to be released at P.S.R. in San Diego, 88 percent of companies that transfer personal data from the European Union to the United States and other non-"adequate" countries rely on standard contractual clauses as a valid method for doing so. As the privacy world now knows, however, the validity of SCCs is now squarely in doubt, following Tuesday’s decision by the Irish High Court in Irish Data Protection Commissioner v. Facebook and Max Schrems (aka “Schrems 2.0”). In its ruling, the Irish High Court shared the Irish DPC’s “well-founded concerns” about the validity of SCCs, which made it “necessary and appropriate” to reference the matter to the Court of Justice of the European Union. In doing so, it also rejected Facebook’s argument on the non-application of European law on the issue, saying “clearly EU law is engaged in respect of these transfers.” So, what happens now? IAPP Westin Fellow Muge Fazlioglu, CIPP/US, reports for The Privacy Advisor.
Full Story