On 16 July 2020, the Court of Justice of the European Union issued its decision in the case Data Protection Commission v Facebook Ireland and Maximillian Schrems. The decision invalidates the European Commission’s adequacy decision for the US Privacy Shield. The decision upholds the validity of standard contractual clauses (SCCs) but requires companies and regulators to conduct case-by-case analyses to determine whether foreign protections concerning government access to data transferred meet EU standards.[1]
The UK Government said it was ‘disappointed’ with the decision and that it is working with the Information Commissioner’s Office (ICO) and international counterparts to address the impacts of the judgement and ensure that updated guidance on international data transfers will be available as soon as possible.
The Government’s press release can be found here.
The ICO’s press release can be found here.