The judges of the Luxembourg-based court said that the so-called Privacy Shield agreement fails to protect EU citizens’ rights, by not limiting access to data by US authorities, in “a way that satisfies requirements that are essentially equivalent to those required under EU law”.
ECJ’s ruling came after Schrems filed a complaint against Facebook, supporting that his right to privacy was violated after the company transferred his data to the US, where it could be exploited by US intelligence agencies, such as the National Security Agency (NSA).
As part of the same ruling, ECJ also decided that another data transfer mechanism, Standard Contractual Clauses (SSCs), remain valid, however, it cannot be used by Facebook and similar companies. The SSCs data-sharing template foreseen in the EU-US Privacy Shield agreement replaced the Safe Harbour agreement, which was demolished after Schrems took his Facebook case in the EU’s top court.
Following the announcement of the decision, Schrems stated that the ruling “is a total blow to the Irish DPC and Facebook. It is clear that the US will have to seriously change their surveillance laws, if US companies want to continue to play a major role on the EU market.”
#ECJ: the Decision on the adequacy of the protection provided by the EU-US Data Protection Shield is invalidated, but @EU_Commission Decision on standard contractual clauses for the transfer of personal data to processors established in third countries is valid #Facebook #Schrems pic.twitter.com/BgxGAvuq3T
— EU Court of Justice (@EUCourtPress) July 16, 2020
