News Archives

Tuesday, April 17, 2018

Both Privacy Shield and SCCs on the Block in Schrems Facebook Case

On April 12, the Irish High Court set forth eleven questions it intends to put to the Court of Justice of the European Union (CJEU) stemming from the complaint against Facebook lodged by Max Schrems with the Irish Data Protection Commissioner in 2013.  A separate complaint by Schrems, it will be recalled, had led to the CJEU’s invalidation of the European Commission’s Safe Harbor adequacy decision in 2015. While most observers believed that the adequacy of protections provided through standard contractual clauses would be the sole focus of what has come to be known as Schrems II, the High Court’s CJEU referral included bombshell questioning of the validity of the Privacy Shield Framework as well.  A CJEU ruling eliminating both standard contractual clauses and Privacy Shield as viable legal bases for personal data transfers from the EU to the US could severely disrupt data transfers from Europe and the U.S. businesses that depend upon them.  The Irish High Court gave Facebook until April 30 to appeal the intended referral to the CJEU, although this appears to be largely a formality.

Much of the early analysis of the Court’s ruling (for example, here) has focused on the magnitude of its potential impact upon Facebook, which is already under enormous pressure in both the U.S. and Europe because of its Cambridge Analytica data breach.  Serious as Facebook’s problems may be, they pale in comparison with the economic upheaval that might attend a near collapse of transatlantic data flows. Two mitigating factors should be noted however.  In the first place, businesses using consent or binding corporate rules as the legal basis for data transfers are unlikely to be impacted by any invalidation of standard contractual clauses and Privacy Shield. Secondly, as Max Schrems suggests in his excellent summary of the case, the CJEU might rule that only “electronic communication service providers,” would be impacted by such a CJEU ruling, since the surveillance law at the heart of its Safe Harbor case, namely FISA sec.702, only applies to them.  This would of course have enormous impact upon companies such as Facebook, Google, Amazon, Twitter, Microsoft and Apple, but might spare thousands of US companies primarily trading in goods and services.

1 comment:

  1. If you are looking for something extraordinary in your life, then you surely need our unique Lahore Escorts services that are available in our VIP section. However, in order to do so, you should tell us what you are looking for in the girls and what type of babe you need. We are here to offer discreet and professional services to all our clients so that they can leave us satisfied. Our Islamabad Escorts beautiful girls are here to unhinge your desires and allow you the explore the real meaning of coming to the planet earth. When you will spend time in the arms of our beautiful Islamabad call girls, you will realize the truth of real love. They have set up very high standards that their competitors can’t match up. So, you need to book one of them as soon as possible.

    ReplyDelete