Data transfers after Schrems II - the response of authorities
Out-Law Guide | 12 Nov 2020 | 11:49 am | 18 min. read
The ruling by the Court of Justice of the EU (CJEU) on 16 July 2020 in the so-called 'Schrems II' case has significant implications for the transfer of personal data outside of the European Economic Area (EEA).
The CJEU confirmed, in principle, that businesses can use European Commission-endorsed standard contractual clauses (SCCs) to underpin data transfer arrangements to jurisdictions outside of the EEA. However, its judgment emphasised the need for due diligence by businesses if they wish to use SCCs, and called into question whether businesses can use SCCs to facilitate data transfers to certain jurisdictions in a way which complies with the EU's General Data Protection Regulation (GDPR).
The court further confirmed that businesses that have relied on the EU-US Privacy Shield for transferring personal data from the EEA to the US can no longer do so.
As businesses seek to understand their options, it is important they recognise that the picture continues to evolve. Authorities across Europe and beyond have given their response to the CJEU's ruling, with further announcements – including the prospect of fresh guidance – anticipated before the end of 2020.
We have compiled a directory of the related statements and guidance issued by EU institutions, national data protection authorities and other relevant regulatory bodies following the Schrems II judgment, which will be updated as further announcements are made.
EU institutions
| EU institution | Type of announcement | Date issued |
| European Data Protection Board |
|
17 July
24 July
11 November |
| European Data Protection Supervisor |
|
16 July
29 October |
| European Commission | Opening remarks | 16 July |
| European Parliament | Research paper | 15 September |
EU: national data protection authorities
| Country | Type of announcement | Date |
|---|---|---|
| Austria | ||
| Belgium | Statement | 31 August |
| Bulgaria | News | 16 July |
| Croatia | Statement | 20 July |
| Cyprus | Statement | Last updated 5 August |
| Czech Republic |
|
16 July
7 August |
| Denmark |
|
17 July
10 August |
| Estonia | News | 17 July |
| Finland | News | 22 July |
| France | News | 17 July |
| Germany |
|
16 July
28 July |
| Greece | Statement | 30 September |
| Hungary | ||
| Ireland | Statement | 16 July |
| Italy | Statement | 29 July |
| Latvia |
|
20 July
8 August |
| Lithuania | News | 20 July |
| Luxembourg | News | 27 July |
| Malta | ||
| Netherlands | News | 20 July |
| Poland | News | 20 July |
| Portugal | ||
| Romania | Press release | 20 July |
| Slovakia | News |
16 July |
| Slovenia | News | 16 July |
| Spain | News | 9 October |
| Sweden |
|
17 July
7 September |
Non-EU / EEA authorities
| Country | Type of announcement | Date issued |
|---|---|---|
| Liechtenstein | News | 17 July |
| Norway |
|
16 July
27 July
9 September |
| Iceland | News | 16 July |
| Switzerland | News | 16 July |
| UK |
|
16 July
17 July |
| US |
Department of Commerce statement
Senate Committee on Commerce press release
Department of Commerce - Press release
Letter from Deputy Assistant Secretary James Sullivan on the Schrems II decision
Remarks by Commerce Secretary Wilbur L. Ross at the U.S.-Ireland Economic Forum |
16 July
17 July
10 August
-
22 October |
German state and regional data protection authorities
| State or region | Type of announcement | Date issued |
|---|---|---|
| Baden-Württemberg |
|
24 August
1 September
7 September
15 October |
| Bayern |
|
29 July
2 October |
| Berlin | Press release | 17 July |
| Brandenburg | ||
| Bremen | ||
| Hamburg | Press release | 16 July |
| Hessen | News | 28 July |
| Mecklemburg-Vorpommern | News | 23 July |
| Niedersachsen |
|
21 August
November |
| Nordrhein-Westfalen |
|
22 July
July |
| Rheinland-Pfalz |
Guidance |
16 July
16 July
24 July 18 Aug |
| Saarland | News | 29 July |
| Sachsen | ||
| Sachsen-Anhalt | ||
| Schleswig-Holstein | ||
| Thüringen | Press release | 16 July |
Contact an adviser
