The European Data Protection Board ('EDPB') issued, on 17 July 2020, a statement on the Court Justice of the European Union's ('CJEU') judgment in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('the Schrems II Case'). In particular, the EDPB welcomed the CJEU’s judgment, which highlights the fundamental right to privacy in the context of the transfer of personal data to third countries. In addition, and in the relation to the invalidation of the EU-US Privacy Shield, the EDPB outlined that the EU and the US should achieve a complete and effective framework in order to guarantee that the level of protection granted to personal data in the US is essentially equivalent to the one ensured within the EU, in line with the judgment. In this regard, the EDPB recalled that it intends to continue playing a constructive part in securing a transatlantic transfer of personal data that benefits EEA citizens and organisations, as well as that it stands ready to provide the European Commission with assistance and guidance to help it build, together with the US, a new framework that fully complies with EU data protection law.

Moreover, and in relation to Standard Contractual Clauses ('SCCs'), the EDPB pointed that it is the responsibility of exporters and importers to assess whether countries to which data is sent offer adequate protection. In practice, the EDPB recalled that, when performing such prior assessment, the exporter and, if its assistance is necessary, the importer, must take into consideration the content of the SCCs, the specific circumstances of the transfer, and the legal regime applicable in the importer's country. In the event that the level of protection is deemed inadequate, the exporter may have to consider putting in place additional measures to those included in the SCCs. In this regard, the EDPB is looking further into what these additional measures could consist of.

Lastly, the EDPB stated that it will assess the judgment in more detail and provide further clarification for stakeholders, as well as guidance on the use of instruments for the transfer of personal data to third countries pursuant to the judgment.

You can read the press release here.