Schrems I: When EU Data Protection Crossed the Atlantic

Case C-362/14 | Maximillian Schrems v Data Protection Commissioner | Court of Justice of the European Union | Grand Chamber | 6 October 2015

Practice Takeaways: ① An adequacy decision requires protection that is essentially equivalent to that guaranteed in the European Union—not identical protection, but protection that is effective in law and practice. ② A Commission adequacy decision does not prevent a national supervisory authority from examining an individual complaint about a transfer. ③ Only the CJEU may declare an EU adequacy decision invalid; supervisory authorities and national courts must use the judicial process to bring validity questions before it. ④ Self-certification can support an adequacy framework only if effective detection, supervision, and enforcement mechanisms make the commitments reliable in practice. ⑤ National-security limitations must be bounded by clear rules, strict necessity, and effective safeguards. Generalized access to the content of electronic communications compromises the essence of the right to private life. ⑥ A transfer framework must provide meaningful remedies. The absence of any avenue to access, rectify, or erase personal data fails to respect the essence of effective judicial protection. ⑦ Adequacy is not permanent. The Commission must monitor whether its determination remains factually and legally justified as circumstances change.

Can the European Commission conclusively decide that personal data will receive adequate protection after it leaves the European Union?

In Schrems I, the Court of Justice answered no—not in the sense that such a decision could prevent independent supervisory authorities from examining individual complaints, and not where the underlying framework failed to ensure protection that was genuinely effective.

The case arose after Edward Snowden’s disclosures brought United States surveillance practices into public view. Maximillian Schrems complained to the Irish Data Protection Commissioner that Facebook Ireland should not be permitted to transfer his personal data to the United States. The Commissioner rejected the complaint on the ground that the European Commission had already found the United States Safe Harbor framework adequate.

The Court held that the Commission’s decision could not eliminate the supervisory authority’s duty to examine Schrems’s complaint. It then went further. Reviewing the Safe Harbor Decision itself, the Court held that it did not establish protection essentially equivalent to that guaranteed in the European Union and declared the decision invalid. (Judgment, paras. 53–66, 73–78, 98–106.)

Schrems I is therefore about more than the collapse of one transatlantic transfer mechanism. It established enduring principles governing adequacy, regulatory independence, government access, effective redress, and judicial review.

What Happened

Maximillian Schrems, an Austrian national, had used Facebook since 2008. European users contracted with Facebook Ireland, which transferred some or all of their personal data to servers belonging to Facebook Inc. in the United States, where the data was processed. (Judgment, paras. 26–27.)

In June 2013, Schrems complained to the Irish Data Protection Commissioner. Relying on Edward Snowden’s disclosures concerning the activities of the National Security Agency (NSA), he argued that United States law and practice did not adequately protect data transferred there against government surveillance. (Judgment, para. 28.)

The Commissioner declined to investigate. He reasoned that Schrems had not shown that the NSA had accessed his particular data and, more fundamentally, that Commission Decision 2000/520—the Safe Harbor Decision—had already determined that the United States ensured an adequate level of protection. (Judgment, para. 29.)

Schrems challenged that refusal before the Irish High Court. The High Court found that United States surveillance served legitimate public-interest objectives, but that the Snowden disclosures revealed significant overreach. It also found that EU citizens lacked an effective opportunity to be heard concerning the surveillance of their data. (Judgment, paras. 30–31.)

Citing to Digital Rights Ireland, the High Court asked the CJEU whether the Commission’s adequacy decision conclusively bound the national supervisory authority or whether the authority could—or must—investigate the complaint in light of developments since that decision had been adopted. (Judgment, paras. 34–37.)

The reference placed two related questions before the Court: what powers remain with an independent supervisory authority after the Commission adopts an adequacy decision, and whether the Safe Harbor Decision itself remained valid.

Why the Case Matters

EU data-protection law restricts transfers of personal data to third countries because protection should not disappear when data crosses a border. Under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46), a transfer could take place only where the third country ensured an adequate level of protection or another authorized transfer mechanism applied.

But “adequate” was not defined. Nor was it clear how a Commission adequacy decision interacted with the constitutional independence of national data-protection authorities.

Schrems I answered both questions.

• First, it gave adequacy a demanding substantive meaning. A third country need not reproduce EU law word for word, but its legal order must provide protection of fundamental rights that is "essentially equivalent" to that guaranteed by EU law. The mechanisms may differ; their protection must work in practice. (Judgment, paras. 70–75.)
• Second, the Court protected the institutional role of supervisory authorities. An adequacy decision binds Member States while it remains valid, but it cannot extinguish an individual’s right to complain or the authority’s obligation to examine the complaint independently and with due diligence. (Judgment, paras. 51–65.)
• Third, the Court connected international transfers directly to Articles 7, 8, and 47 of the Charter: respect for private life, protection of personal data, and effective judicial protection. An international arrangement could not qualify as adequate if broad government access and the absence of meaningful remedies compromised the substance of those rights.

Those principles outlived Safe Harbor. They became part of the constitutional framework governing adequacy decisions and international data transfers under EU law.

" [...] the term ‘adequate level of protection’ must be understood as requiring the third country in fact to ensure, by reason of its domestic law or its international commitments, a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union [...]" Judgment, para. 73

The Key Holding

The Court reached two principal conclusions.

• First, a Commission adequacy decision does not prevent a national supervisory authority from examining a complaint alleging that the law and practices of the third country fail to protect the individual’s rights. The supervisory authority cannot itself invalidate the Commission decision, but it must investigate the complaint with due diligence and, where the challenge is well founded, use available legal proceedings so that the validity question can reach the CJEU. (Judgment, paras. 53–66.)
• Second, the Safe Harbor Decision was invalid. It did not establish that the United States in fact ensured protection essentially equivalent to that guaranteed within the European Union. The framework applied to participating companies, but not to United States public authorities; national-security, public-interest, and law-enforcement requirements took priority over the Safe Harbor principles; and the decision did not identify effective limits or remedies governing public-authority access. (Judgment, paras. 79–98.)
• Because the provisions restricting supervisory-authority powers were also unlawful and the relevant parts of the decision were inseparable, the Court invalidated Decision 2000/520 in its entirety. (Judgment, paras. 99–106.)

The Court’s Analysis

1. Supervisory Independence Must Be Effective

The Court began with the role of independent supervisory authorities.

• Article 8(3) of the Charter and Article 28 of Directive 95/46 assigned those authorities responsibility for monitoring compliance with EU data-protection rules. Their independence was not merely administrative design. It was an essential component of the protection of individuals and a means of ensuring that oversight would be effective and reliable. (Judgment, paras. 38–43.)
• Although a national authority could not regulate processing occurring inside a third country, the transfer of personal data from a Member State to that country was itself processing within the Member State. The authority therefore retained power to assess whether the transfer complied with EU law. (Judgment, paras. 44–49.)

Practice Tip: Do not treat an adequacy decision as eliminating supervisory scrutiny. It authorizes transfers while valid, but individuals retain the right to complain and supervisory authorities retain the responsibility to examine whether the specific transfer complies with EU data-protection requirements.

2. An Adequacy Decision Does Not Close the Courthouse Door

A Commission adequacy decision is binding and presumed lawful until withdrawn, annulled, or declared invalid. A supervisory authority therefore cannot simply disregard it or make its own binding determination that the third country is inadequate. (Judgment, paras. 51–52.)

But binding effect is not immunity from review.

The Court held that an adequacy decision cannot prevent an individual from lodging a complaint or eliminate the powers expressly conferred on supervisory authorities. Otherwise, Article 8(3) of the Charter would be deprived of practical effect. The authority must examine the claim with complete independence and all due diligence. (Judgment, paras. 53–59, 63.)

The Court then identified the proper institutional path:

• If the authority rejects the complaint, the individual must have access to judicial review. A national court that finds the validity challenge well founded must refer the question to the CJEU.
• If the authority considers the complaint well founded, it must be able to bring proceedings before the national courts so that those courts may refer the validity question to the CJEU.

Only the CJEU may declare an EU act invalid. That allocation preserves both effective protection and the uniform application of EU law. (Judgment, paras. 60–65.)

3. “Adequate” Means Essentially Equivalent

The Court next addressed what an adequate level of protection requires.

It did not demand identical law. A third country may use different legal mechanisms. But those mechanisms must, in fact, provide protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union by Directive 95/46, read in light of the Charter. Without that requirement, EU protection could be circumvented simply by transferring data abroad. (Judgment, paras. 69–74.)

Adequacy therefore requires more than promises on paper. The Commission must examine both the content of the third country’s applicable rules and the practices used to ensure compliance with them. Those means must prove effective in practice. (Judgment, paras. 74–75.)

Practice Tip: When assessing a transfer framework, separate formal commitments from operational protection. Ask what rules apply, whom they bind, how compliance is supervised, what happens when domestic law overrides the commitments, and what remedies are actually available to affected individuals.

4. Adequacy Must Be Monitored Over Time

An adequacy decision is not a permanent factual finding.

• Because a third country’s law and practice can change, the Commission must periodically determine whether its adequacy finding remains legally and factually justified. A reassessment is required when evidence creates doubt. In reviewing validity, later developments must also be considered. (Judgment, paras. 75–77.)
• The Court further held that the Commission’s discretion was reduced and judicial review had to be strict because data protection is closely connected to the fundamental right to private life and because transfers may affect a very large number of people. (Judgment, para. 78.)

This was a crucial response to the chronology of the case. Safe Harbor had been adopted in 2000. The disclosures that exposed its weaknesses emerged years later. The framework could not remain adequate merely because it had once been declared so.

5. Self-Certification Requires Real Oversight

Safe Harbor relied on voluntary self-certification by participating United States organizations. The Court did not hold that self-certification is inherently incompatible with adequacy. It held that such a system is reliable only when effective detection and supervision mechanisms allow violations to be identified and punished in practice. (Judgment, paras. 79–81.)

• The problem was that the Safe Harbor principles bound certified companies, not United States public authorities. The Commission decision also lacked sufficient findings showing how United States domestic law or international commitments ensured an adequate level of protection. (Judgment, paras. 82–83.)

In other words, regulating what recipient companies promised to do did not answer what government authorities could require them to do.

6. National Security Did Not Create an Unlimited Override

The Safe Harbor framework permitted adherence to its principles to be limited for national-security, public-interest, or law-enforcement requirements and where United States law created conflicting obligations or authorizations. United States law therefore took priority when it conflicted with the Safe Harbor principles. (Judgment, paras. 84–86.)

• The Court found the derogation too general. The decision enabled interference with the rights of people whose data was transferred but did not identify rules that limited government access or provided effective legal protection against it. Commercial enforcement before the Federal Trade Commission and private dispute-resolution bodies did not address surveillance measures originating from the State. (Judgment, paras. 87–90.)

The question was not whether national security is a legitimate objective. It was whether the interference was governed by clear and precise rules, confined to what was strictly necessary, and accompanied by effective safeguards and remedies.

7. Generalized Access and the Absence of Redress Reached the Essence of Charter Rights

The Court relied heavily on the safeguards articulated in Digital Rights Ireland. EU legislation interfering with Articles 7 and 8 of the Charter must establish clear and precise rules governing the measure’s scope and application, together with minimum safeguards against abuse and unlawful access. Derogations and limitations must apply only to the extent strictly necessary. (Judgment, paras. 91–92.)

• Generalized storage or access without differentiation, limitation, exception, or objective criteria is not limited to what is strictly necessary. And legislation permitting public authorities generalized access to the content of electronic communications compromises the essence of the right to respect for private life. (Judgment, paras. 93–94.)
• The absence of redress was independently fatal. Legislation that gives an individual no possibility of obtaining access to personal data, or its rectification or erasure, does not respect the essence of the right to effective judicial protection under Article 47. (Judgment, para. 95.)

The Commission had not found that the United States actually ensured protection meeting those standards. Article 1 of the Safe Harbor Decision was therefore invalid. (Judgment, paras. 96–98.)

8. The Commission Could Not Restrict Supervisory Powers

Article 3 of the Safe Harbor Decision allowed national supervisory authorities to suspend transfers only under restrictive conditions.

• In practice, it prevented them from fully exercising the powers conferred by Article 28 of Directive 95/46 when a complaint challenged the adequacy determination itself. (Judgment, paras. 99–102.)

The Commission had no power under Article 25(6) to restrict authority granted to national supervisors by the Directive, read in light of the Charter. Article 3 was therefore invalid. Because Articles 1 and 3 were inseparable from the remainder of the decision and its annexes, the invalidity extended to the entire Safe Harbor Decision. (Judgment, paras. 103–106.)

The Advocate General’s Opinion

Advocate General Yves Bot reached the same central conclusions and proposed that the Court hold that national supervisory authorities remained able to investigate complaints notwithstanding a Commission adequacy decision and that Decision 2000/520 was invalid. (Opinion, para. 237.)

His reasoning helped develop several themes reflected in the judgment.

• First, adequacy had to be evaluated in the current factual and legal context. Because an adequacy decision concerns a situation that can evolve, it must be regularly reviewed. Later events may reveal deficiencies that were not apparent when the decision was adopted. (Opinion, paras. 132–138.)
• Second, the Advocate General treated adequacy as requiring both substantive rules and effective compliance mechanisms. A self-certification regime could not produce essential equivalence without adequate guarantees and independent control. (Opinion, paras. 139–149.)
• Third, he emphasized that the case did not principally allege that Facebook had violated the Safe Harbor principles. If Facebook gave United States authorities access in order to comply with United States law, that possibility was built into the framework’s broad derogations. The real question was whether those derogations were compatible with primary EU law. (Opinion, paras. 158–168.)
• Finally, he concluded that large-scale, indiscriminate surveillance was inherently disproportionate and that the available commercial enforcement mechanisms could not provide effective protection against government surveillance. (Opinion, paras. 169–216.)

The Court followed the Advocate General’s central approach, including essential equivalence, continuing review, the institutional role of supervisory authorities, and the need for limits and redress.

What the Court Did—and Did Not—Decide

The Court did hold that a Commission adequacy decision cannot eliminate an individual’s right to complain to a national supervisory authority.

It did hold that the supervisory authority must examine such a complaint independently and with due diligence.

It did establish that adequacy requires protection essentially equivalent—not necessarily identical—to that guaranteed in the European Union.

It did require adequacy to be evaluated in both law and practice and monitored as circumstances change.

It did hold that generalized government access to the content of electronic communications compromises the essence of the right to private life, and that the absence of meaningful legal remedies fails to respect the essence of effective judicial protection.

And it did invalidate the Safe Harbor Decision in its entirety.

But the Court did not hold that a national supervisory authority may itself declare a Commission adequacy decision invalid. That authority belongs exclusively to the CJEU.

It did not require third countries to reproduce EU data-protection law identically. Different legal means may satisfy the standard if they provide essentially equivalent protection in practice.

It did not hold that self-certification can never form part of an adequate transfer framework. Its reliability depends on effective detection, supervision, enforcement, and redress.

It did not decide whether Facebook itself had violated the Safe Harbor principles.

Schrems I Today

Although Schrems I interpreted Directive 95/46 and invalidated a transfer framework that no longer exists, its central principles remain foundational under the GDPR.

Article 45 GDPR now expressly reflects much of the judgment’s logic. In evaluating adequacy, the Commission must consider the rule of law, respect for human rights, relevant legislation—including legislation concerning public security and government access—effective and enforceable data-subject rights, administrative and judicial redress, and the existence and effective functioning of independent supervisory authorities. Adequacy decisions are also subject to periodic review.

Those principles also provided the foundation for Schrems II, in which the Court applied the essential-equivalence standard to invalidate the EU–U.S. Privacy Shield and confirmed that other transfer mechanisms must provide protection that is effective in practice in light of the law and practices of the destination country.

The enduring lesson is institutional as well as substantive. International data flows depend on legal mechanisms, but those mechanisms remain subject to complaints, independent supervision, strict judicial review, and changing facts. An adequacy decision is a legal conclusion that must remain true in practice.

Conclusion

Schrems I began with a complaint the Irish Data Protection Commissioner refused to investigate because Safe Harbor had been declared adequate. The Court held that adequacy decisions cannot prevent supervisory authorities from examining complaints, although only the CJEU may invalidate them.

It also established that protection abroad must be essentially equivalent, effective in practice, and subject to continuing review. Safe Harbor failed because broad government access lacked meaningful limits and remedies. Its invalidation established an enduring principle: EU data protection follows the data, and transfer mechanisms remain accountable to fundamental rights.

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The case can be located using Case C-362/14, Maximillian Schrems v Data Protection Commissioner.

• Court of Justice of the European Union, Grand Chamber, Case C-362/14, Maximillian Schrems v Data Protection Commissioner, Judgment of 6 October 2015, ECLI:EU:C:2015:650.
• Opinion of Advocate General Yves Bot, Case C-362/14, delivered 23 September 2015, ECLI:EU:C:2015:627.

Commission Decision 2000/520/EC: The Safe Harbor Decision — The European Commission decision at the center of Schrems I. Adopted in 2000, it found that organizations adhering to the Safe Harbor Privacy Principles and related FAQs provided adequate protection for personal data transferred from the European Union to the United States. Its provisions on self-certification, national-security exceptions, enforcement, and supervisory-authority powers supplied the legal framework the CJEU examined—and ultimately invalidated—in Schrems I. Read the Decision.

Useful Reading from The de la Torre Review

• Supervisory Authorities, the EDPB, and the EDPS Explained — Explains why independent supervision is a structural component of EU data-protection law and provides context for Schrems I’s treatment of national supervisory powers. Read the Article.
• When Can Personal Data Leave the EU? A Practical Guide to GDPR International Transfers — Provides the modern Chapter V framework for the transfer rules at the center of Schrems I. It explains adequacy decisions, the essential-equivalence standard, appropriate safeguards, SCCs, BCRs, Transfer Impact Assessments, and Article 49 derogations—and shows how EU law seeks to ensure that personal data remains protected after leaving the EEA. Read the Article.
• Schrems II: Privacy Shield Is Dead—Long Live the Transfer Impact Assessment!— Continues the transatlantic-transfer story begun in Schrems I. Applying the essential-equivalence standard, the Court invalidated the EU–U.S. Privacy Shield and held that organizations relying on SCCs must determine whether the law and practices of the destination country allow those safeguards to operate effectively in practice. Read the Article.
• Digital Rights Ireland: When Data Retention Went Too Far — Provides the Charter framework on strict necessity, generalized data collection, and minimum safeguards that the Court applied in Schrems I when examining United States government access. Read the Article.
• Commission v Germany: Why Data-Protection Authorities Must Be Free from State Influence — Develops the independence principle on which Schrems I relied in protecting national supervisory authorities’ ability to examine complaints. Read the Article.
• Commission v Austria: Why Formal Independence Is Not Enough — Shows how the Court moved beyond formal guarantees to ask whether supervisory authorities are operationally independent in practice. Read the Article.
• Parliament v Council: When Passenger Data Crosses the Atlantic — Examines an earlier EU–U.S. transfer dispute and the requirement that international transfers rest on the correct legal foundation. Read the Article.

Other Resources and Recommended Reading

• Edward Snowden — Background on the former NSA contractor whose 2013 disclosures revealed the scope of United States government surveillance programs. Those disclosures prompted Schrems’s complaint to the Irish Data Protection Commissioner and supplied the factual developments that led the CJEU to reconsider whether the Safe Harbor framework continued to provide adequate protection for personal data transferred to the United States. Read the Article.
• European Commission communications of 27 November 2013 concerning the functioning of Safe Harbor and the rebuilding of trust in EU–U.S. data flows, COM(2013) 846 final and COM(2013) 847 final.