Schrems II: Privacy Shield Is Dead—Long Live the Transfer Impact Assessment!

Case C-311/18 | Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems | Court of Justice of the European Union | Grand Chamber | 16 July 2020

Practice Takeaways: ① The GDPR follows personal data when it leaves the European Union: every Chapter V transfer mechanism must preserve protection essentially equivalent to that guaranteed by the GDPR, read in light of the Charter. ② Standard Contractual Clauses (SCCs) remain valid, but signing them does not by itself make a transfer lawful. ③ Before transferring data, the exporter and importer must assess whether the law and practices of the destination country permit compliance with the SCCs. ④ Where SCCs alone cannot provide the required protection, the parties must adopt effective supplementary measures; if adequate protection still cannot be ensured, the transfer must be suspended or ended. ⑤ Supervisory authorities must suspend or prohibit transfers when the required protection cannot otherwise be achieved and the parties have not stopped the transfer themselves. ⑥ The EU-U.S. Privacy Shield was invalid because U.S. surveillance programs were not limited in a manner essentially equivalent to the EU principle of proportionality and EU data subjects lacked effective judicial redress. ⑦ Contractual safeguards can bind the parties, but they cannot bind a foreign government. Transfer compliance therefore requires attention to both the contract and the legal environment in which it must operate.

Can a contract protect personal data when the law of the destination country requires the recipient to give public authorities access to it?

In Schrems II, the Court of Justice answered: sometimes—but not by contract alone.

The case began where Schrems I ended. After the Court invalidated the EU-U.S. Safe Harbor framework, Facebook Ireland continued transferring Maximillian Schrems's personal data to the United States using Standard Contractual Clauses. Schrems reformulated his complaint, arguing that U.S. law still did not provide adequate protection against government surveillance and that Facebook therefore could not lawfully rely on those clauses.

The Court preserved the SCC mechanism but transformed what reliance on it requires. SCCs are valid because they contain mechanisms for identifying when their promises cannot be honored and for suspending transfers in that event. But their contractual nature is also their limit: they bind exporters and importers, not foreign intelligence authorities. Exporters and importers must therefore assess the law and practices of the destination country, add effective supplementary safeguards where necessary, and stop the transfer where essentially equivalent protection cannot be achieved (which is what we do today through the Transfer Impact Assessments). Supervisory authorities must intervene if the parties do not. (Judgment, paras. 91-105, 121-149.)

The Court separately invalidated the EU-U.S. Privacy Shield. It held that the United States surveillance rules assessed by the Commission—particularly Section 702 of the Foreign Intelligence Surveillance Act (FISA) and Executive Order 12333—were not circumscribed in a manner essentially equivalent to EU requirements. The Privacy Shield Ombudsperson also did not provide the independent, binding remedy required by Article 47 of the Charter. (Judgment, paras. 162-201.)

Schrems II is therefore not simply the decision that ended Privacy Shield. It is the decision that turned international-transfer compliance into an operational inquiry: what happens to this data, in this country, under this legal regime, and can the safeguards actually work?

What Happened

Maximillian Schrems, an Austrian Facebook user, had first complained to the Irish Data Protection Commissioner in 2013. Facebook Ireland transferred its European users' personal data to Facebook Inc. in the United States. Schrems argued that U.S. law did not adequately protect that data against government access. The Commissioner's refusal to investigate eventually led to Schrems I, in which the Court invalidated the Safe Harbor Decision. (Judgment, paras. 50-55.)

After Schrems I, the Irish court annulled the decision rejecting Schrems's complaint. The Commissioner asked Schrems to reformulate it in light of the Court's judgment. Facebook explained that it relied on the SCCs in the annex to Commission Decision 2010/87 for much of its data transfers to the United States. Schrems maintained that, because U.S. law required Facebook Inc. to make personal data available to U.S. authorities under programs including PRISM and UPSTREAM, the SCCs could not provide protection consistent with Articles 7, 8, and 47 of the Charter. He asked the Commissioner to suspend or prohibit the transfers. (Judgment, paras. 52-57.)

The Commissioner brought proceedings before the Irish High Court. Following extensive evidence concerning U.S. surveillance law, the High Court referred eleven questions to the CJEU. Those questions concerned the GDPR's application to commercial transfers later subject to national-security processing; the standard of protection required under Article 46; the responsibilities of exporters, importers, and supervisory authorities; the validity of the SCC Decision; and the relevance and validity of the Privacy Shield Decision. (Judgment, paras. 59-68.)

The procedural posture mattered. Schrems's reformulated complaint challenged transfers made under SCCs, not transfers made under Privacy Shield. But Facebook argued that the Privacy Shield Decision contained a binding Commission finding that the United States provided adequate protection for transfers within its scope—and that the same assessment of U.S. law was relevant to SCC-based transfers. That placed both mechanisms before the Court. (Judgment, paras. 151-161.)

Why the Case Matters

Chapter V of the GDPR is designed to ensure continuity of protection. Personal data does not lose the safeguards of EU law simply because it crosses a border. Whether a transfer relies on an adequacy decision under Article 45 or appropriate safeguards under Article 46, the level of protection guaranteed by the GDPR must not be undermined. (Judgment, paras. 91-96.)

Schrems II translated that principle into concrete responsibilities.

• The same substantive standard governs different transfer mechanisms. Article 46 safeguards must provide a level of protection essentially equivalent to that guaranteed within the European Union, just as an adequacy framework must. (Judgment, paras. 94-105.)
• Transfer compliance is contextual. The relevant assessment includes both the contractual safeguards and the destination country's legal system, particularly rules governing public-authority access to data. (Judgment, paras. 102-105.)
• SCCs require verification, not formal execution. The exporter and importer must determine before the transfer whether the importer can comply with the clauses in practice. (Judgment, paras. 131-142.)
• Failure has a prescribed consequence. If effective supplementary measures cannot cure the deficiency, the transfer must be suspended or ended. (Judgment, paras. 133-135, 140-143.)
• Supervisory enforcement is mandatory where protection fails. In the absence of a valid adequacy decision, a supervisory authority must suspend or prohibit a transfer if the clauses cannot be complied with and protection cannot be ensured by other means. (Judgment, paras. 106-121.)

The decision made international transfers a matter of documented legal and technical judgment. A signed agreement may be necessary, but it is not a substitute for asking whether the recipient can perform what the agreement promises.

"[S]tandard data protection clauses cannot, having regard to their very nature, provide guarantees beyond a contractual obligation to ensure compliance with the level of protection required under EU law." — Judgment, para. 133

The Key Holding

The Court reached two central conclusions.

• First, it found nothing affecting the validity of Commission Decision 2010/87, which adopted the SCCs then at issue. The clauses could not bind third-country authorities, but that limitation did not make the SCC Decision invalid. The mechanism remained lawful because it imposed duties on the exporter and importer to assess compliance, required the importer to disclose an inability to comply, permitted or required suspension and termination, and preserved supervisory-authority powers to prohibit unlawful transfers. (Judgment, paras. 122-149.) That validation came with a demanding condition: the exporter and importer must verify, before any transfer, whether the destination country's law permits the importer to comply. Depending on the circumstances, supplementary measures may be necessary. If adequate protection cannot be ensured, the transfer must stop. (Judgment, paras. 132-143.)
• Second, the Court declared Commission Implementing Decision (EU) 2016/1250—the Privacy Shield Decision—invalid. The Commission's adequacy finding did not satisfy Article 45(1) of the GDPR, read in light of Articles 7, 8, and 47 of the Charter. The U.S. surveillance programs considered by the Court were not limited to what was strictly necessary, and the Ombudsperson mechanism did not provide a remedy before an independent body empowered to issue binding decisions. Because the provisions of the Privacy Shield Decision were inseparable, the Court invalidated the decision in its entirety. (Judgment, paras. 168-201.)

Unlike some judgments invalidating EU acts, the Court did not preserve Privacy Shield's effects temporarily. Article 49 of the GDPR already supplied limited derogations for transfers that could not proceed under an adequacy decision or Article 46 safeguards; there was therefore no legal vacuum requiring a transition period. (Judgment, para. 202.)

The Court's Analysis

1. The GDPR Applies Even When Foreign Authorities May Later Process the Data

Facebook's transfer from Ireland to the United States was a commercial transfer between two economic operators. That transfer constituted processing under the GDPR. The possibility that U.S. authorities might later process the data for public-security, defense, or national-security purposes did not remove the commercial transfer from the Regulation's scope. (Judgment, paras. 80-89.)

The Court distinguished the activity that triggered the GDPR—the commercial transfer—from the foreign governmental activity that made the transfer legally difficult. Indeed, Article 45(2)(a) expressly requires the Commission to consider national-security law and public-authority access when evaluating a third country's adequacy. Those matters therefore inform the transfer analysis rather than displacing it. (Judgment, paras. 86-89.)

Practice Tip: Do not treat the destination country's national-security characterization as ending the GDPR inquiry. For a commercial transfer subject to Chapter V, foreign government-access rules are part of the assessment of whether EU-level protection will continue after transfer.

2. Article 46 Requires Essentially Equivalent Protection

Article 46 permits transfers without an adequacy decision only where appropriate safeguards are provided and enforceable data-subject rights and effective legal remedies are available. Read with Article 44, those requirements ensure that the GDPR's level of protection is not undermined when data leaves the European Union. (Judgment, paras. 90-93.)

The Court carried forward the standard developed in Schrems I. Protection need not be identical to the EU legal order, but it must be essentially equivalent to the protection guaranteed by the GDPR, read in light of the Charter. That standard applies not only to adequacy decisions but also to transfers based on SCCs. (Judgment, paras. 94-101.)

For SCC-based transfers, the assessment must consider two sources of protection and risk:

1. the contractual clauses agreed between the EU exporter and the third-country recipient; and
2. the relevant aspects of the destination country's legal system, particularly rules governing access by public authorities.

The Article 45(2) adequacy factors—including the rule of law, national-security legislation, enforceable rights, effective remedies, and independent oversight—provide a non-exhaustive guide to that inquiry. (Judgment, paras. 102-105.)

3. Supervisory Authorities Must Act When Protection Cannot Be Ensured

The Court reaffirmed the institutional principle at the center of Schrems I: independent supervisory authorities are responsible for monitoring and enforcing EU data-protection law, including in relation to international transfers. They must handle complaints with due diligence and possess extensive investigative and corrective powers. (Judgment, paras. 106-112.)

Where there is no valid adequacy decision, the supervisory authority is required to suspend or prohibit a transfer if:

• the SCCs are not or cannot be complied with in the destination country;
• the protection required by EU law cannot be ensured by other means; and
• the controller or processor has not suspended or ended the transfer itself.

(Judgment, paras. 113-121.)

The authority retains judgment about which corrective action is appropriate in the circumstances, but it does not have discretion to leave an unprotected transfer in place. The Court rejected the suggestion that intervention was confined to exceptional cases. (Judgment, paras. 111-115.)

Where a valid adequacy decision exists, the authority remains bound by it unless and until the CJEU declares it invalid. But the decision does not eliminate an individual's right to complain or the authority's obligation to investigate. If the authority doubts the validity of the adequacy decision, it must use the judicial process that can bring the validity question before the CJEU. (Judgment, paras. 116-121.)

4. SCCs Survived Because They Contain a Failure Mechanism

SCCs cannot bind a foreign government because the government is not a party to the contract. In some countries and for some transfers, the clauses may nevertheless provide sufficient protection. In others, domestic law may require public-authority access incompatible with the clauses. (Judgment, paras. 122-126.)

The SCC Decision did not have to certify the laws of every possible destination country. Unlike an adequacy decision, SCCs are a general contractual mechanism designed for use across jurisdictions. The responsibility to determine whether they work in a particular setting falls primarily on the exporter and importer. (Judgment, paras. 127-134.)

The Court upheld the SCC Decision because the clauses contained mechanisms for confronting incompatibility rather than pretending it did not exist. The importer had to inform the exporter if it could no longer comply. The exporter had the right—and, when protection failed, the obligation—to suspend transfers or terminate the contract. Supervisory authorities retained the power to audit, suspend, or prohibit transfers. (Judgment, paras. 137-148.)

The validity of SCCs therefore rests partly on their capacity to fail safely. They are lawful not because they guarantee that every transfer can proceed, but because they require the parties and regulators to stop transfers when their guarantees cannot be honored.

Practice Tip: An SCC process should produce more than a signed annex. In practice, organizations use a Transfer Impact Assessment (TIA) to evaluate the relevant aspects of the destination country’s legal system, particularly rules governing access by public authorities. The TIA should identify the destination, transfer circumstances, importer, categories of data, applicable government-access rules and relevant practical experience, proposed safeguards, residual risks, and the decision to proceed, modify, suspend, or terminate the transfer..

5. Supplementary Measures May Be Necessary—but They Must Work

Because contractual clauses cannot control third-country authorities, additional safeguards may be necessary to preserve essentially equivalent protection. The Court did not prescribe a universal list. It instead required a transfer-specific determination of whether the destination country's law permits compliance and whether additional safeguards can close any gap. (Judgment, paras. 132-135.)

• The important point is functional: supplementary measures must actually compensate for the identified deficiency. Contractual promises may improve transparency, allocate responsibilities, require challenges to government demands, or support audits, but additional contract language cannot override binding national law. In some circumstances, technical or organizational measures may prevent or materially limit public-authority access. In others, no available measure will make the transfer lawful.
• If adequate additional measures cannot guarantee the required protection, the exporter or processor must suspend or end the transfer. If it does not, the supervisory authority must act. (Judgment, paras. 134-135, 148-149.)

6. Privacy Shield Failed the Proportionality Test

The Privacy Shield Decision recognized that participating organizations' commitments could be limited by U.S. national-security, public-interest, and law-enforcement requirements. Because those requirements took priority, the Court examined whether the resulting interferences with Articles 7 and 8 of the Charter were governed by rules essentially equivalent to those required under EU law. (Judgment, paras. 162-178.)

EU law permits limitations on privacy and data-protection rights, but the limitation must be provided by law, respect the essence of the rights, and—subject to proportionality—be necessary and genuinely meet an objective of general interest. Legislation authorizing surveillance must lay down clear and precise rules, define the measure's scope and application, and provide minimum safeguards against abuse. (Judgment, paras. 169-176.)

The Court found the U.S. framework deficient in two principal respects.

• Under Section 702 FISA, the Foreign Intelligence Surveillance Court authorized surveillance programs such as PRISM and UPSTREAM through annual certifications rather than authorizing individual surveillance measures. Its review did not determine whether particular individuals were properly targeted. Section 702 did not itself provide limitations and safeguards for potentially targeted non-U.S. persons equivalent to those required by EU law. (Judgment, paras. 179-181.)
• Executive Order 12333 permitted access to data in transit to the United States, while PPD-28 allowed forms of bulk collection. The applicable framework did not provide sufficiently clear and precise limits or rights enforceable against U.S. authorities. (Judgment, paras. 182-185.)

The Court concluded that neither Section 702 nor Executive Order 12333, read with PPD-28, supplied the minimum safeguards required by the EU principle of proportionality. The surveillance programs could not be regarded as limited to what was strictly necessary. (Judgment, paras. 180-185.)

7. The Ombudsperson Was Not an Effective Judicial Remedy

Article 47 of the Charter requires an effective remedy before an independent and impartial tribunal. That protection is particularly important for international transfers because EU authorities and courts may lack the practical power to remedy unlawful processing in another country. (Judgment, paras. 186-189.)

The Commission had relied on the Privacy Shield Ombudsperson mechanism to address gaps in judicial redress. The Court found that mechanism insufficient.

• The Ombudsperson was appointed by and reported to the U.S. Secretary of State and formed part of the State Department. The Privacy Shield Decision did not identify safeguards governing removal that would establish independence from the executive. Nor did it show that the Ombudsperson could issue decisions binding on the intelligence services. Political commitments to correct violations did not give data subjects enforceable legal protections. (Judgment, paras. 190-197.)

The mechanism therefore did not offer guarantees essentially equivalent to Article 47. Without independent and binding redress, the Commission could not lawfully find that the United States provided adequate protection under Privacy Shield. (Judgment, paras. 197-201.)

The Advocate General's Opinion

Advocate General Henrik Saugmandsgaard Øe proposed that the Court confine its formal answer to the validity of the SCC Decision. He concluded that the examination disclosed nothing affecting the validity of that decision. In his view, the SCC mechanism properly placed responsibility first on the exporter and importer and, if they failed to act, on the supervisory authority. (Opinion, paras. 115-148, 343.)

• The Advocate General emphasized the distinction between the validity of the SCC mechanism and the lawfulness of a particular transfer. The clauses could remain valid even though they might not provide sufficient protection in every third country. Their effectiveness depended on the parties assessing the legal environment and suspending a transfer when compliance became impossible. (Opinion, paras. 120-135.)

He considered it unnecessary to decide the validity of Privacy Shield because Schrems's complaint concerned SCC-based transfers. Nevertheless, he examined the Privacy Shield framework and expressed substantial doubts about its compatibility with Articles 7, 8, and 47 of the Charter. In particular, he questioned the limits on U.S. surveillance and concluded that the Ombudsperson was not established by law, was not independent of the executive, could not issue binding decisions, and was not subject to independent judicial review. (Opinion, paras. 173-176, 327-342.)

The Court followed the Advocate General on the validity and conditional operation of SCCs, but went further by squarely reviewing and invalidating Privacy Shield.

What the Court Did—and Did Not—Decide

The Court invalidated the Privacy Shield Decision with immediate effect. It held that the Commission could not find the United States adequate because the surveillance framework assessed in the decision was not limited in a manner essentially equivalent to the EU principle of proportionality and did not provide EU data subjects with effective judicial redress. (Judgment, paras. 168–202.)

At the same time, the Court upheld the SCC Decision. It concluded that SCCs could remain a valid transfer mechanism because they required the parties to verify whether their protections could be honored and provided mechanisms for suspending or terminating transfers when they could not. Supervisory authorities also retained the power—and, where the required conditions were met, the duty—to intervene. (Judgment, paras. 106–149.)

• The Court thus shifted much of the practical responsibility for assessing transfers to exporters and importers. Before relying on SCCs, they must consider both the contractual protections and the relevant aspects of the destination country’s legal system, particularly rules governing access by public authorities. Where SCCs are insufficient, the parties must adopt effective supplementary measures or stop the transfer.

It did not hold that every transfer to the United States was categorically unlawful. Its adequacy analysis concerned the Privacy Shield framework and the U.S. surveillance rules assessed in that decision. For SCC-based transfers, the Court prescribed a case-by-case assessment of the transfer, the importer, the applicable legal system, and any supplementary measures.

It also did not supply a checklist of supplementary measures. That practical work was left to exporters, importers, supervisory authorities, and later regulatory guidance. The judgment established the governing test: the measures must produce protection essentially equivalent to that guaranteed in the European Union. Measures that exist only on paper, or that cannot overcome the identified legal obstacle, are insufficient.

Finally, the Court did not treat commercial convenience as part of the legal standard. Where protection cannot be ensured, the consequence is suspension or termination—not acceptance of a lower level of protection because the transfer is operationally important.

From Schrems I to Schrems II

The two decisions form a continuous line.

• Schrems I established that adequacy requires protection essentially equivalent to EU law, that government access must be bounded by necessity and safeguards, that effective redress is indispensable, and that supervisory authorities retain responsibility for examining complaints.
• Schrems II extended those principles beyond adequacy decisions. The Court held that Article 46 mechanisms must preserve the same substantive level of protection. It then converted that requirement into duties for exporters, importers, and regulators: assess the destination country's law, evaluate whether contractual commitments can be performed, add effective supplementary safeguards where possible, and stop transfers where the required protection cannot be achieved.

The shift is important. Schrems I asked whether the Commission could declare a transfer framework adequate despite excessive surveillance and inadequate remedies. Schrems II asked whether private contracts could solve the same problem. The answer was that contracts can support lawful transfers only where the surrounding legal system—and any effective supplementary measures—allow their protections to operate in practice.

The Decision’s Legacy: The Birth of the Transfer Impact Assessment

Schrems II changed the architecture of transfer compliance.

Organizations relying on Article 46 could no longer treat execution of SCCs as the final step. The judgment required an assessment of the circumstances surrounding the transfer and the destination country's legal environment. That obligation became the foundation for transfer impact assessments and for the European Data Protection Board's recommendations on measures supplementing transfer tools.

• The Commission adopted new SCCs in 2021. Those clauses incorporate the logic of Schrems II: the parties must warrant that they have no reason to believe the destination country's laws and practices prevent compliance, document their assessment, respond to government-access requests, and suspend transfers where compliance is no longer possible.
• The judgment also triggered another effort to construct a durable EU-U.S. transfer framework. Privacy Shield was replaced by the EU-U.S. Data Privacy Framework, supported by changes to U.S. signals-intelligence safeguards and a new redress mechanism. Whether those changes meet the standard articulated in Schrems I and Schrems II is a separate question. The enduring test remains whether protection is essentially equivalent in law and practice, including with respect to necessity, proportionality, independent oversight, and effective redress.

Conclusion

Schrems II did not reject contractual safeguards. It rejected the idea that a contract can be evaluated without regard to the law governing the recipient.

The Court preserved SCCs because they can operate as part of an effective system: the parties must test whether the promised protection is possible, supplement the clauses where necessary, disclose and respond to incompatibility, and stop the transfer when protection fails. Supervisory authorities provide the enforcement backstop.

Privacy Shield failed for the opposite reason. The framework permitted U.S. national-security requirements to override private commitments without limits and remedies essentially equivalent to those required by the Charter. Section 702 FISA and Executive Order 12333 were not sufficiently circumscribed, and the Ombudsperson mechanism did not provide independent, binding redress.

The case's central lesson is therefore practical as well as constitutional: international transfers are lawful only when safeguards work where the data goes. Paper promises cannot cure government surveillance when the recipient is legally unable to keep them.

SCC protect international transfers only if the parties can—and do—comply with them where the data goes.

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The case can be located using Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems.

• Court of Justice of the European Union, Grand Chamber, Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, Judgment of 16 July 2020, ECLI:EU:C:2020:559.
• Opinion of Advocate General Henrik Saugmandsgaard Øe, Case C-311/18, delivered 19 December 2019, ECLI:EU:C:2019:1145.

Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC, OJ 2010 L 39, p. 5, as amended by Commission Implementing Decision (EU) 2016/2297. Read the Decision

Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC on the adequacy of the protection provided by the EU-U.S. Privacy Shield, OJ 2016 L 207, p. 1. Read the Decision.

Useful Reading from The de la Torre Review

• Supervisory Authorities, the EDPB, and the EDPS Explained — Explains why independent supervision is a structural component of EU data-protection law and provides context for Schrems I and Schrems II treatment of national supervisory powers. Read the Article.
• Schrems I: When EU Data Protection Crossed the Atlantic — Explains the first Schrems judgment, which invalidated Safe Harbor and established the essential-equivalence, supervisory-independence, government-access, and effective-redress principles applied in Schrems II. Read the Article.
• When Can Personal Data Leave the EU? A Practical Guide to GDPR International Transfers — Provides the modern Chapter V framework for the transfer rules at the center of Schrems I. It explains adequacy decisions, the essential-equivalence standard, appropriate safeguards, SCCs, BCRs, Transfer Impact Assessments, and Article 49 derogations—and shows how EU law seeks to ensure that personal data remains protected after leaving the EEA. Read the Article.
• Digital Rights Ireland: When Data Retention Went Too Far — Provides the Charter framework on strict necessity, generalized data collection, and minimum safeguards that the Court applied in Schrems I when examining United States government access. Read the Article.
• Commission v Germany: Why Data-Protection Authorities Must Be Free from State Influence — Develops the independence principle on which Schrems I relied in protecting national supervisory authorities’ ability to examine complaints. Read the Article.
• Commission v Austria: Why Formal Independence Is Not Enough — Shows how the Court moved beyond formal guarantees to ask whether supervisory authorities are operationally independent in practice. Read the Article.
• Parliament v Council: When Passenger Data Crosses the Atlantic — Examines an earlier EU–U.S. transfer dispute and the requirement that international transfers rest on the correct legal foundation. Read the Article.