Recently, the European Commission published its evaluation report on the first two years of the General Data Protection Regulation (GDPR). The Commission focused on, in particular, two themes in its evaluation, being (1) international data transfers and (2) the cooperation and consistency among the European supervisory authorities. As to the latter, the Commission is of the opinion it should definitely be improved. With regard to international data transfer the Commission focuses on the review of current adequacy decisions and ‘modernising’ the existing data transfers mechanisms, including Standard Contractual Clauses. Particularly interesting is that the Commission refers in this respect, to the Schrems II judgment of the European Court of Justice (“ECJ”), expected on 16 July 2020.
Modernisation of international data transfer mechanisms
Under the Data Protection Directive 95/46/EC (“Directive”), the Commission adopted (pre-GDPR) a number of ‘adequacy decisions’ that enable the safe flow of personal data to third countries without the need for further international data transfer measures. The Commission announced to review these adequacy decisions. In this context, the Commission also refers to the expected Schrems II judgement, which may provide clarifications “that could be relevant for certain elements of the adequacy standard”. Said this, it will most probably also impact the pending adequacy decisions for the United Kingdom and South Korea.
Moreover, the Commission report elaborates on the further modernisation of the other international data transfer mechanisms, which include the instrument of Standard Contractual Clauses (“SCCs”). Also in this context, the Commission refers to the expected Schrems II judgement, now pending before the ECJ. In short, Schrems II challenges the validity of SCCs in a particular situation of data transfers between the EU and the United States. The Commission considers the upcoming ECJ decision as a key benchmark for the modernisation of the international data transfers mechanisms. In case the ECJ provides further clarifications on the applicability of the SCCs this will have impact on modernising all current GDPR data transfers mechanisms, including the SCCs and adequacy decisions.
Schrems II impact – further communications and virtual round table
In one way, or another, the ECJ decision will likely have significant effects on the long-term sustainability of the current GDPR’s international data transfer mechanisms. In December 2019, the Advocate General rendered his opinion on the Schrems II case, about which we shared our analyses and insights via a series of blogs (available here).
Since the 16 July decision of the ECJ is anticipated by many as a potential new landmark in international data transfers, we will again prepare and share our analysis of the judgement in a series of blogs. Depending on the impact of the decision for multinational companies, we will also organize a series virtual round tables to discuss and explore available strategies to navigate the consequences of the decision.
If you would like stay informed of our blogs, updates, or if are you interested in joining one of our virtual round table, please contact Andre Walter.
 Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (“Schrems II”).