What is Schrems II?
Schrems II is the 2020 EU Court of Justice ruling that annulled the Privacy Shield, the framework then used for transfers of personal data to the United States.
The case, C-311/18, began with a complaint from the Austrian lawyer Max Schrems. The court found that US surveillance was not limited to what is strictly necessary and that people in the EU lacked effective remedies.
Standard contractual clauses could still be used after the ruling. Whoever transfers data must, however, assess the level of protection in the destination country and add supplementary measures where needed.
The European Data Protection Board then issued recommendations on such measures. The ruling also lies behind the EU-US framework that has applied since 2023, which was built to meet the court's objections.
How it works
The court compared protection in the United States with what applies in the EU. It examined both intelligence laws and the ability of individuals to have their case heard. The shortcomings lay in the country's laws, so a contract between two companies could not solve them on its own.
Why it matters
The ruling showed that a basis for transfers can fall. It also made assessing the destination country's laws a routine part of work on third-country transfers.
What to keep in mind
A new framework has replaced the one that was struck down, and it is now being tested in court. Have a plan for what you will do if conditions change again.
Supplementary measures work best when the recipient cannot read the data. For AI, where the model needs to read the text, that is harder to achieve.
What it means for you
Map which services transfer personal data to the United States and what basis each transfer rests on.
Common questions
Why is the ruling called Schrems II?
It is the second ruling following complaints from Max Schrems. The first, in 2015, annulled the even older Safe Harbour framework.
Can we use standard contractual clauses after the ruling?
Yes. You then need to assess whether the destination country's laws allow the protection to hold in practice, and add measures where needed.
Sources: Judgment in Case C-311/18 on EUR-LexEDPB recommendations on supplementary measures
Related terms
Read more
All terms Updated