On December 19, 2019, Advocate General (“AG”) Henrik Saugmandsgaard Øe handed down his Opinion in Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (“Schrems II”). The AG’s Opinion provides non-binding guidance to the Court of Justice of the EU (“CJEU”) on how to decide the case.

In brief, the AG recommended that the CJEU find that Decision 2010/87 (setting out standard contractual clauses for controller to processor transfers) should not be invalidated. The Opinion also concluded that the Court did not need to rule on the validity of the EU-U.S. Privacy Shield to decide Schrems II.

Background

The case stems from a complaint filed by Mr. Max Schrems with the Irish Data Protection Commissioner (“IDPC”) challenging Facebook Ireland’s use of the 2010 clauses to transfer his personal data to the United States. The IDPC, concerned about the protections afforded to EU data subjects by U.S. law, asked the Irish High Court for guidance. The High Court in turn asked the CJEU a series of questions about the validity of the clauses and the adequacy of the U.S. regime.

For more information on the background, please see our prior press release here.

AG’s Opinion

In an Opinion that spanned over 90 pages, the AG concluded:

• The CJEU should not invalidate the 2010 Standard Contractual Clauses (“SCC”) Decision. The AG concluded that, based on his analysis of the matter, there was “nothing to affect the validity of Commission Decision 2010/87/EU” (para. 5). The validity of contractual clauses, in his view, did not depend on the adequacy of the U.S. regime; instead, it “depends only on the soundness of the safeguards which those clauses provide in order to compensate for any inadequacy of the protection afforded in the third country of destination” (para. 124). The AG concluded that the clauses provide a framework that allows parties to put in place the necessary safeguards.
• Whether the SCCs can be used for a particular transfer to a particular country requires a case-by-case assessment. As the AG explained, data exporters — with support from data importers — must make an initial assessment of whether SCCs can in fact be used for a particular transfer. When making this assessment, consideration should be given to “all of the circumstances characterising each transfer, which may include the nature of the data and whether they are sensitive, the mechanisms employed by the exporter and/or the importer to ensure its security, the nature and the purpose of the processing by the public authorities of the third country which the data will undergo, the details of such processing and the limitations and safeguards ensured by that third country” (para. 135).
• Where a Supervisory Authority concludes that a particular transfer made via the clauses is unlawful, it must intervene. If a data subject complains about the export of his or her data to a third country, a Supervisory Authority must examine the complaint “with all due diligence” (para. 146). When the Authority concludes that the clauses are not being complied with, the Authority has no discretion: it must take remedial measures including, where appropriate, suspending the transfer (para. 140).
• The Court does not need to decide the validity of the Privacy Shield to rule in Schrems II. The AG concluded that it would be “premature” for the Court to rule on the validity of the Privacy Shield in this case (para. 166) — instead, this should be left to the General Court (which currently has a challenge to the Privacy Shield pending before it). Nonetheless, the AG made a number of observations on the validity of the Privacy Shield Decision, noting several points he viewed as shortcomings.

Next Steps

We anticipate the CJEU’s judgment to be announced in the first quarter of 2020. As noted, the AG’s Opinion provides guidance to the CJEU, but does not bind it. While the Court often follows the AG’s Opinion, it does not always do so.

If you have any questions concerning the material discussed in this client alert, please feel free to contact any of the members of our Privacy practice (details provided below). Covington will also be hosting a webinar on Wednesday January 8, 2020, in which we will be discussing the implications of the AG opinion in more detail.  Click here to join us.