What this is about

The key issue of Schrems II is whether the European Commission’s standard contractual clauses (“SCCs” or "Model Clauses") are valid for transfers of personal data to the United States. 

Issues that might be addressed by the CJEU include:

  • The validity of the current version of the controller to processor Model Clauses.
  • Whether laws and practices in third countries are relevant when considering whether Model Clauses can be relied upon to legitimise transfers of personal data to those third countries.
  • The extent to which EU data protection law requirements regarding transfers of personal data to ‘third countries’ apply while personal data is ‘in transit’ between the EU and such a third country.
  • What relevance the EU-US Privacy Shield decision has on transfers of personal data to the USA based on Model Clauses.
  • The legal framework against which the ‘adequacy’ of third countries’ regimes should be assessed for the purposes of EU data protection law.

Why this is a big deal

The AG’s Opinion, while not binding, can be considered as an initial indication of where the CJEU will land.

Do we need to panic and cancel our Xmas holidays?

Probably not:

  • We still have to wait for the actual ruling; and 
  • The current version of the Model Clauses will have to be changed anyway because they are pre-GDPR (and the ruling affects "the existing version").

However, when you come back from your holidays fully refreshed, make sure you benchmark your international data practices against the AG's opinion and start raising awareness with the relevant stakeholders that changes may be necessary when the CJEU decision comes out. 

Keep calm, carry on and merry Xmas from the DP team!