The effect of the Schrems II judgement and its implications on applying standard contractual clauses

Abstract

Transnational data flow between the EU and the US has been in jeopardy ever since the Snowden revelations. Moreover, the decision given by the CJEU in Data Protection Commissioner v Facebook Ireland Ltd, Maximilian Schrems and intervening parties Case C311/18 (Schrems II) has had far more reaching repercussions than anticipated. Its effect and implications have left international data transfers in shambles. With the abrogation of the Privacy Shield Framework, data protection between the EU and the US as it stands is left in a legal limbo. The motive for the harshness of this judgement is due to the fact that the US’s national legislation violates the General Data Protection Regulations (GDPR) provisions. This stems from the fact that the US employs surveillance on personal data which the GDPR strongly disapproves of. Thus, there is this constant clash between these two legislations. Furthermore, applying Standard Contractual Clauses (SCCs) has become very complicated. The CJEU has included unnecessary burdens on these SCCs and businesses are left to interpret, identify and implement the best instruments so they can achieve the level of protection demanded by EU Standards.