Source: https://xpanlawgroup.com/cybersecurity-series-1/2018/4/16/and-the-saga-continues-on-the-road-again-to-the-cjeu-with-shrems-ii
Timestamp: 2018-05-27 05:30:04
Document Index: 751223736

Matched Legal Cases: ['CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ', 'CJEU ']

And the Saga Continues: On The Road Again to the CJEU with Shrems II — XPAN Law Group
The Irish High Court is still considering the exact questions to be referred to the CJEU. The general parameters of the questions before the Irish High Court, and the several points of contention between the parties that were highlighted during an Irish High Court hearing on January 18, 2018, are: (a) Whether the rights of EU citizens are adequately safeguarded when their personal data is transferred to the United States using SCCs; (b) Whether the questions to the CJEU relating to the validity of SCC's should refer to their validity generally when used for transfers to any third country, or to the United States only; and (c) Whether the Privacy Shield decision was relevant to the questions to be referred to the CJEU.
A CJEU decision invalidating SCCs would have a major impact on the transatlantic flow of data between the EU and other jurisdictions around the world. If the CJEU invalidates SCCs, then this would result in logistical and economical challenges for trade opportunities between the EU and US. Many businesses that operate in Europe rely on the free flow of personal data across borders -- invalidating the SCCs would potentially make that transfer unlawful under EU data protection laws. At least 89% of EU companies rely upon SCCs when transferring data to the US or other non-EU country. Furthermore, the way in which the questions are framed to the CJEU will play an important factor in the CJEU’s determination. If the questions are framed broadly and concern the transfer of data to countries beyond just the US,, then it will have a vast effect on EU companies because they would be required to halt their trading practices until switching to an accepted transfer mechanism.
Irrespective of the questions that are ultimately posed to the CJEU, it is necessary that the questions result in more clarity about the reliability in using SCCs for transatlantic data transfers. Since the GDPR has already declared that SCCs provide adequate safeguards for transferring data and has even threatened sanctions for non-compliance, it is necessary that the CJEU provides a greater degree of certainty if transatlantic data flows are to continue. If the CJEU cannot provide more certainty on the reliability of SCCs, then the Court ought to provide guidance on how a greater degree of certainty can be achieved. The CJEU will likely not issue a ruling until October 2018. For the time being, SCC's remain a valid mechanism for transferring personal data from the EU.