Schrems II – Adequacy: CJEU Finds SCCs Valid, But Invalidates Privacy Shield

The Schrems II decision found that effective mechanisms are in place to ensure SCCs comply with EU requirements for personal data protection (i.e. prior verification that EU protection levels will be respected in third countries, and exporters or DPAs suspending or prohibiting transfers if recipients cannot honour SCC clauses); however, the Privacy Shield condones interference with fundamental privacy rights by US public authorities without giving data subjects actionable rights before the courts or empowering the Ombudsperson to adopt binding decisions on US authorities.