Following a legal challenge to the validity of data transfers from organizations in Europe to organizations in countries like the United States, the opinion of the Advocate General (AG) of the Court of Justice of the European Union (ECJ) in Case C‑311/18 on the use of the European Union’s standard contractual clauses (SCCs) gave such transfers a green light to proceed. Although the AG’s opinion is not binding on the ECJ, it is often followed; the ECJ’s final decision is expected shortly.
Case C‑311/18 is important, given that SCCs (for data transfers to controllers and to processors located outside Europe) are widely used by thousands of organizations. The main plaintiff in the case, well-known privacy activist Max Schrems, who launched the case that invalidated the former EU–US Safe Harbor framework, had argued that European data exporters should not be allowed to transfer users’ data to the United States because that information could be turned over to US government agencies, including intelligence agencies, in certain cases without due process for the EU data subjects.
The governments of Ireland, Germany, Austria, Belgium, Netherlands, and Portugal and the European Data Protection board filed opinions, or amicus briefs, with the ECJ. The AG’s opinion is a nonbinding advisory opinion to the ECJ.
In the AG’s detailed opinion, Henrik Saugmandsgaard Øe suggests that there is “nothing to affect the validity of EU Decision 2010/87” (the European Commission’s February 2010 decision on the adequacy of data protection that SCCs provide between data controllers and data processors). The basis for the AG’s opinion is as follows:
The AG states that “the validity of that decision does not depend on the level of protection that exists in each third country to which data might be transferred.” This is because SCCs themselves provide the contractual protections for data subjects’ rights as well as a comparable standard to European data protection law (under the former European Data Protection Directive, now replaced by the General Data Protection Regulation).
The good news is that the AG suggests that EU Decision 2010/87 is valid. Otherwise, thousands of data flows that have relied on SCCs for nearly 10 years would have been invalidated. We anticipate that the ECJ decision will be along the same lines as the AG’s opinion.
As the AG observes, if one data protection authority (DPA) suspended data flow to the United States or any other country without an adequacy determination it would create havoc. Suspending data flow is such a drastic measure that is only imaginable in specific cases and under certain conditions:
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following Morgan Lewis lawyers:
 These countries (other than the European Economic Area) are Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, Switzerland, and Uruguay (note the United Kingdom does not have an adequacy determination for post-Brexit purposes, meaning data transfers to the United Kingdom will be restricted, similar to data transfers to the United States).