- Schrems II refers to the ruling of the Court of Justice of the European Union (CJEU) of 16 July 2020, case C-311/18.
- The ruling invalidates the Privacy Shield adequacy decision, which had governed transfers of personal data to the United States since 2016.
- It also upholds standard contractual clauses (SCCs) as a transfer tool, but requires a case-by-case review of the legislation of the destination country.
- Subsequent decisions (CNIL on Google Analytics, EDPB) confirm that a transfer to a processor subject to the CLOUD Act or FISA 702 carries a risk not covered by SCCs alone.
What is Schrems II?
Schrems II is the common name for the ruling handed down by the Court of Justice of the European Union on 16 July 2020, in case C-311/18 between Maximilian Schrems and the Irish Data Protection Commissioner. Maximilian Schrems is an Austrian activist who was already behind the Schrems I ruling, which in 2015 invalidated the Safe Harbor agreement between the EU and the United States.
The case concerned transfers of personal data from Facebook's Irish subsidiary to its US parent company. The Court had to rule on two transfer tools: the Privacy Shield adequacy decision and the standard contractual clauses (SCCs) set out in Commission Decision 2010/87.
The Court invalidates the Privacy Shield and holds that US legislation, in particular Section 702 of FISA and Executive Order 12333, does not guarantee a level of protection essentially equivalent to that ensured by EU law. It confirms the validity of SCCs as a tool, but requires a case-by-case assessment of the legal context of the destination country.
From Snowden to the Data Privacy Framework
- June 2013Edward Snowden's revelations about US mass surveillance programmes, notably PRISM, carried out under Section 702 of FISA.
- October 2015First Schrems ruling (Schrems I, C-362/14), which invalidates the Safe Harbor agreement between the EU and the USA, judged insufficient to protect European personal data.
- August 2016Entry into force of the Privacy Shield, the agreement intended to succeed Safe Harbor.
- July 2018Adoption of the CLOUD Act in the United States, which strengthens the extraterritorial powers of US authorities to issue orders.
- 16 July 2020Schrems II ruling (C-311/18). The CJEU invalidates the Privacy Shield and requires a case-by-case assessment for transfers based on standard contractual clauses.
- February 2022The CNIL declares the use of Google Analytics in its current form unlawful, for lack of sufficient safeguards against access to the data by US authorities.
- July 2023Adoption of a new adequacy decision, the Data Privacy Framework, once again governing EU-US transfers. Its legal robustness is already the subject of challenges pending before the CJEU.
What the ruling changed for European organisations
Six consequences observed in data governance practices since 2020.
Privacy Shield invalidated
The ruling deprived EU-US transfers of their main legal basis between July 2020 and July 2023. During this period, organisations had to justify transfers with other tools (SCCs plus supplementary measures, binding corporate rules, derogations).
Standard contractual clauses not sufficient on their own
SCCs remain valid in principle but are not sufficient if the legislation of the destination country (CLOUD Act, FISA 702) deprives the recipient of the ability to refuse a request from local authorities. A transfer impact assessment (TIA) must be carried out.
Supplementary measures
In June 2021 the EDPB published its recommendations on supplementary measures: end-to-end encryption with no recipient access to the keys, effective pseudonymisation, strengthened contractual safeguards. These measures must be technically verifiable.
CNIL decisions
In 2022 the CNIL served formal notices on several website operators using Google Analytics, considering that the configuration did not offer the safeguards required by Schrems II. A similar approach was adopted by other European authorities.
2023 Data Privacy Framework
The agreement adopted on 10 July 2023 replaces the Privacy Shield. It relies on a US presidential executive order establishing a Data Protection Review Court. Challenges pending before the CJEU could weaken it in the years ahead.
Impact on cloud choices
Schrems II remains a landmark reference: every cloud choice involves an analysis of the provider's jurisdiction and of the reality of transfers. It is one of the legal drivers of interest in European sovereign offers.
Three common confusions
“The 2023 Data Privacy Framework has settled Schrems II.”
The new framework rests on a US legal basis (Executive Order) that is more solid than the Privacy Shield, but it is the subject of challenges pending before the CJEU. Specialist lawyers recommend continuing to document transfers as before.
“If I use an EU region at a US hyperscaler, I am outside the scope of Schrems II.”
The ruling concerns the jurisdiction of the data recipient, not the physical location of the data. A processor subject to the CLOUD Act or FISA 702 remains exposed, even if the servers are in Europe.
“The new 2021 standard contractual clauses are enough.”
The 2021 SCCs include an obligation to carry out an impact assessment (TIA). This assessment must show that the law of the destination country does not prevent compliance with the clauses, which remains debatable for the United States.
Further reading
- CJEU ruling of 16 July 2020, case C-311/18 (curia.europa.eu)
- General Data Protection Regulation, consolidated version (eur-lex.europa.eu)
- European Data Protection Board, Recommendations 01/2020 on supplementary measures (edpb.europa.eu)
- CNIL, decisions on Google Analytics and transfers outside the EU (cnil.fr)
- European Commission, Data Privacy Framework adequacy decision of 10 July 2023 (commission.europa.eu)