{"id":1208,"date":"2021-11-19T14:30:00","date_gmt":"2021-11-19T14:30:00","guid":{"rendered":"https:\/\/www.cookiebot.com\/en\/?p=1208"},"modified":"2026-03-12T08:20:21","modified_gmt":"2026-03-12T08:20:21","slug":"schrems-ii-privacy-shield","status":"publish","type":"post","link":"https:\/\/www.cookiebot.com\/us\/schrems-ii-privacy-shield\/","title":{"rendered":"Schrems II and beyond: EU-US international data transfers"},"content":{"rendered":"\n

On July 16, 2020, the Court of Justice of the European Union (CJEU)<\/a> struck down the EU-U.S. Privacy Shield Framework (Privacy Shield), a key mechanism that facilitated personal data transfers between the EU and the US under the General Data Protection Regulation (GDPR)<\/a>.<\/p>\n\n\n\n

This decision, commonly known as Schrems II, highlighted the inadequacy of US privacy protections compared with EU standards, raising concerns about US surveillance practices and deeming the US a non-adequate country for personal data transfers from the EU.<\/p>\n\n\n\n

The EU-U.S. Data Privacy Framework<\/a>, adopted on July 10, 2023, emerged as a crucial development and aimed to address the CJEU's concerns by providing stronger safeguards and a clear legal pathway for data transfers between the EU and US.<\/p>\n\n\n\n

We look at the immediate impact of the Schrems II case and how it has shaped international data transfers under the GDPR.<\/p>\n\n\n\n

What is the Schrems II case?<\/h2>\n\n\n\n

Schrems II is a landmark ruling by the CJEU based on a 2015 complaint by Austrian privacy advocate Maximilian Schrems against Facebook Ireland Limited. Schrems brought the case before the Irish Data Protection Authority, challenging the use of Standard Contractual Clauses (SCCs) for data transfers to the US. The Irish High Court escalated the case to the CJEU in 2018.<\/p>\n\n\n\n

In its judgment, the CJEU addressed two main aspects related to data transfers between the EU and US: the SCCs and the Privacy Shield. <\/p>\n\n\n\n

\"Schrems<\/figure>\n\n\n\n

While the CJEU upheld the SCCs as a valid mechanism for data export under Art. 46 GDPR<\/a>, it required that organizations conduct thorough assessments to ensure data transfers meet EU standards regarding appropriate safeguards, enforceable rights, and effective legal remedies. This includes a case by case review of the legal framework of the recipient country and the specific terms of the SCCs involved.<\/p>\n\n\n\n

In its evaluation of the Privacy Shield, the CJEU held that the US does not offer protection equivalent to EU standards, primarily due to two reasons:<\/p>\n\n\n\n