International transfers of personal data

Summary:

In its July 2020 Schrems II ruling, the Court of Justice of the European Union (CJEU) invalidated the European Commission's US adequacy decision on account of insufficient US data protection standards. Drawing from the judgment, personal data may – in principle – only be transferred to a third country outside the EU/European Economic Area if the third country ensures an 'essentially equivalent' level of data protection to that of the EU, or if supplementary measures are deployed to compensate for the lacunae in protection.

With the United Kingdom (UK) becoming a third country within the meaning of EU data protection law, the convenient and cost-effective continuation of EU–UK data flows will depend on the adoption of the (already controversial) draft adequacy decisions concerning the UK.

During its May plenary session, Parliament is due to debate resolutions on, respectively, the Schrems II ruling, and on UK data adequacy, i.e. the country's level of data protection.

• Primary Source

• Alternative Source

ESO Records

CJEU Case C-311/18 | Data Protection Commissioner v Facebook Ireland and Maximillian Schrems https://www.europeansources.info/record/cjeu-case-c-311-18-data-protection-commissioner-v-facebook-ireland-and-maximillian-schrems/

---