Data Transfers to the USA

On 9 July the CJEU will hear oral submissions by the parties in Case C-311/18 Facebook Ireland & Schrems, in which the Irish Data Protection Commissioner (not Mr Schrems) is seeking to invalidate the Commission’s Decisions setting out standard contractual clauses. The basis for that attempt is the ability of national security bodies in the USA to gain access to personal data transferred to the US from the EU under SCCs. The fact that SCCs apply generally to all international transfers, and not just to the USA, is a point which has not eluded most of the other parties involved before the CJEU. Nonetheless it is likely that there will be some degree of comment from the CJEU on the Privacy Shield mechanism as part of the context to the issues.

On 1-2 July, the General Court (the old Court of First Instance) was due to hear the application in Case T-738/16 La Quadrature du Net v Commission which squarely sought to invalidate the Privacy Shield Decision as failing to contain sufficient protections against US intelligence agency access to personal data transferred from the EU. One similar application, by Digital Rights Ireland, has already been ruled inadmissible on standing grounds, and the LQdN application may be too: the hearing was be a rolled up one. However, on 21 June, the General Court announced that it had vacated the hearing in LQdN to await the judgment of the CJEU in Schrems II.

I act for the United Kingdom, intervening, in both cases.

Christopher Knight