Schrems II

The Court of Justice of the European Union (CJEU) ruled that the EU-US Privacy Shield framework failed to provide adequate protection for EU personal data. The core defect was that US surveillance laws (FISA Section 702, EO 12333) permitted disproportionate access by public authorities, violating the essence of the fundamental rights to privacy and judicial redress guaranteed under the EU Charter of Fundamental Rights. This immediately removed the primary legal mechanism for over 5,000 companies.

The Standard Contractual Clauses (SCCs) were upheld as a valid transfer mechanism, but with a critical caveat. The ruling established that SCCs are no longer a simple 'check-the-box' exercise. Data exporters and importers must conduct a Transfer Impact Assessment (TIA) to verify, on a case-by-case basis, whether the law of the destination country provides a level of protection essentially equivalent to EU law. If not, the parties are obligated to implement supplementary measures to bridge the gap.

A mandatory, documented analysis that must be completed before any data transfer relying on SCCs. The TIA process requires:

1. Mapping the Transfer: Identify the specific data, importer, and processing activities.
2. Assessing Local Law: Analyze the destination country's surveillance and access laws for proportionality and necessity.
3. Gap Analysis: Compare the foreign legal framework against the EU essential equivalence standard.
4. Implementing Controls: Apply technical, contractual, and organizational measures to close any identified gaps. The assessment must be continuously re-evaluated.

The ruling imposes a positive obligation to suspend or terminate the data transfer if the agreed supplementary measures cannot be effectively implemented. If the importer becomes subject to a legally binding request for access from a public authority that conflicts with the SCCs, they must notify the exporter immediately. The exporter is then required to halt the flow of data and potentially terminate the contract. This creates a dynamic, ongoing compliance duty rather than a static agreement.

The CJEU reaffirmed the four European Essential Guarantees derived from Articles 7 and 8 of the Charter, which must be present in any third-country surveillance regime for data transfers to be lawful:

• Legal Basis: Processing must be based on clear, precise, and accessible rules.
• Necessity & Proportionality: Surveillance must be strictly necessary to safeguard legitimate objectives.
• Independent Oversight: An independent mechanism must supervise the surveillance.
• Effective Remedies: Individuals must have access to effective judicial redress against abuse.

The primary legal mechanism that replaced Privacy Shield after Schrems II. SCCs are pre-approved contractual terms issued by the European Commission that create binding obligations on data importers and exporters. Key requirements post-Schrems II:

• Must conduct a Transfer Impact Assessment (TIA) before relying on SCCs
• Must implement supplementary measures (encryption, pseudonymization) when local laws conflict with EU standards
• Cannot be used as a rubber stamp—requires case-by-case analysis of the destination country's surveillance laws

A mandatory documented analysis required before any data transfer to a third country under SCCs. The TIA evaluates whether the destination country's laws and practices provide essentially equivalent protection to EU law. Assessment components:

• Analysis of local surveillance laws (e.g., FISA 702 in the US)
• Evaluation of data subject rights and redress mechanisms
• Identification of supplementary technical measures (end-to-end encryption, client-side key management) to compensate for legal gaps
• Ongoing monitoring obligation if laws change

The successor to Privacy Shield, adopted in July 2023, designed to address the deficiencies identified in Schrems II. Key improvements:

• Limits US intelligence access to what is necessary and proportionate
• Establishes a Data Protection Review Court for EU citizens to seek redress
• Requires annual certification and compliance reviews
• However, legal challenges are anticipated from privacy advocates who argue the framework still fails the Schrems II test of essential equivalence

Technical, contractual, and organizational safeguards layered on top of SCCs to compensate for gaps in third-country legal protections. Schrems II explicitly requires these when the destination country's laws do not meet EU standards. Technical measures include:

• End-to-end encryption with keys held exclusively by the data exporter
• Pseudonymization that prevents re-identification by the importer
• Split processing across multiple jurisdictions so no single authority can access complete data
• Confidential computing to protect data in use from the infrastructure provider

The EDPB issued definitive recommendations in June 2021 on implementing Schrems II. The guidance provides a six-step roadmap for assessing third-country transfers:

1. Map all data transfers
2. Verify the transfer tool (SCCs, BCRs, etc.)
3. Assess the destination country's legal framework
4. Identify and adopt supplementary measures
5. Implement formal procedural steps
6. Re-evaluate at appropriate intervals This guidance effectively operationalizes the CJEU ruling into actionable compliance steps.

The US Foreign Intelligence Surveillance Act provision that was central to the Schrems II ruling. The CJEU found that Section 702 surveillance programs (PRISM and UPSTREAM) do not meet EU proportionality standards because they allow bulk collection of communications data without individualized suspicion. Impact on data transfers:

• Any US-based cloud provider subject to FISA 702 is considered to operate under laws incompatible with EU fundamental rights
• This creates a structural legal risk for any EU-to-US data flow unless robust technical safeguards (encryption with EU-held keys) are in place