Source: https://www.omm.com/resources/alerts-and-publications/alerts/eu-advocate-general-us-eu-data-transfers/
Timestamp: 2020-05-29 07:41:52
Document Index: 509560169

Matched Legal Cases: ['CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ']

In December, an Advocate General to the Court of Justice of the European Union (CJEU) issued an advisory opinion in the Schrems II case that impacts standard contract clauses (SCCs) and the EU-US Privacy Shield, two common safeguards currently used by US companies to enable the transfer of personal data from the EU to the US. Generally, the transfer of personal data from the EU to another country outside the EU is prohibited under EU data protection laws unless the EU has determined that the receiving country provides adequate protections or uses other approved safeguards. The US is not considered to be a country that provides adequate protections.
The Advocate General’s opinion confirmed the general validity of SCCs as a legal mechanism for transnational data transfer but suggested that SCCs may be insufficient where a third country’s laws impose conflicting obligations. The opinion, which is not binding but will likely influence the decision by the CJEU, offers at least temporary good news for companies that transfer European residents’ personal data to non-EU countries. The opinion, however, was critical of US national security and intelligence practices, laying the groundwork for the CJEU and the data protection authorities (DPAs) of EU member states to scrutinize individual arrangements that rely upon SCCs as the legal mechanism to transfer data to the US. The opinion also recommended that the CJEU avoid ruling on the validity of the EU-US Privacy Shield, but there have been at least some indications that the CJEU may be interested in taking on that broader issue. The CJEU is expected to issue a decision in the next three to six months.
The advisory opinion stems from the case known as Schrems II (Case C-311/18, Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems), brought by Ireland’s Data Protection Commission (IDPC) and the privacy activist Maximilian Schrems. Schrems, whose prior litigation led to the CJEU’s invalidation of the US-EU Safe Harbor Framework (the predecessor to the EU-US Privacy Shield), is arguing that SCCs do not sufficiently protect the privacy of EU residents’ personal data from US surveillance laws and consequently are inconsistent with the EU’s General Data Protection Regulation (GDPR). SCCs are a popular mechanism by which companies that transfer data from the EU can comply with GDPR. The other primary mechanism is the US Department of Commerce’s EU-US Privacy Shield certification program.
The CJEU’s decision can be of even greater significance in light of Brexit. If the EU does not determine that the United Kingdom provides adequate protection to personal data as a part of Brexit negotiations, the EU will require that data transfers between the EU and UK be accompanied by appropriate safeguards. Currently, the majority of affected multinational companies will likely rely on SCCs to transfer personal data from the EU to UK following Brexit. Should the Advocate General’s opinion be adopted by the CJEU, there could be a wave of inquiries by various member state DPAs of individual data transfer arrangements from the EU to the UK.
For the time being, the status quo remains. To prepare for the coming CJEU decision, US companies should carefully evaluate their data transfer arrangements with both EU and UK entities and take stock of data sharing practices with the US Government. A rejection of the EU-US Privacy Shield by the CJEU would potentially require significant restructuring of transatlantic data sharing arrangements.
As we await the CJEU’s decision, companies should consider other approved safeguards or mechanisms for transfers of personal data rather than rely on the Privacy Shield for personal data transfers from the EU to US, such as, if applicable, binding corporate rules or the exceptions provided under Article 49 of the GDPR. Even a more narrow CJEU decision that adopts the recommendations of the Advocate General would potentially lead to numerous and uncoordinated actions by member state DPAs. Either way, this matter warrants particular attention as it could create enormous complications for companies doing business with Europe.
This memorandum is a summary for general information and discussion only and may be considered an advertisement for certain purposes. It is not a full analysis of the matters presented, may not be relied upon as legal advice, and does not purport to represent the views of our clients or the Firm. Steve Bunnell, an O’Melveny partner licensed to practice law in the District of Columbia, Lisa Monaco, an O’Melveny partner licensed to practice law in New York, Scott W. Pink, an O’Melveny special counsel licensed to practice law in California and Illinois, John Dermody, an O’Melveny counsel licensed to practice law in California, and Ally Scher, an O’Melveny associate licensed to practice law in the District of Columbia, contributed to the content of this newsletter. The views expressed in this newsletter are the views of the authors except as otherwise noted.
D: +1-202-383-5513