Today, the Court of Justice of the European Union issued a landmark decision striking down the EU-U.S. Privacy Shield—an agreement between EU and U.S. authorities authorizing transfers of EU personal data to the United States—but upholding the validity of standard contractual clauses (“SCCs”), another mechanism that EU-based organizations use to transfer data internationally. Covington represents BSA | The Software Alliance (“BSA”) in the case, and key aspects of BSA’s arguments on the validity of SCCs were reflected in the Court’s decision.

The Court’s judgment, in Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (“Schrems II”), holds that the Privacy Shield does not take adequate account of U.S. laws authorizing public authorities to access data transferred from the EU to the United States. The Court also concludes that the ombudsperson mechanism referred to in the Privacy Shield Decision does not provide effective administrative or judicial redress for the data subjects concerned.  The Court holds therefore that the Privacy Shield does not provide protections that are “essentially equivalent” to those set out in EU law — and invalidated the Privacy Shield with immediate effect. The judgment essentially decides the outcome of a separate case pending before the Court, Case T-738/16, La Quadrature du Net and Others v. Commission, which focused directly on the validity of the Privacy Shield, and in which Covington also represented BSA.

In a separate part of its judgement, the Court upheld the validity of the SCCs, which many EU entities currently rely on to transfer data internationally. The Court added, however, that use of the SCCs requires an a priori compliance assessment of the context of each individual transfer, including the laws of the country where the recipient is based and any additional safeguards adopted by the parties. In the Court’s words, EU law requires entities relying on the SCCs “to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data, whether the law of the third country of destination ensures adequate protection, under EU law, of personal data transferred pursuant to standard data protection clauses, by providing, where necessary, additional safeguards to those offered by those clauses.”  (para. 134)

The Schrems II judgment will require many EU data controllers to reassess, and in some cases adapt, the mechanisms they use to transfer data internationally, not just to the United States but potentially to other foreign countries as well.

For more information on the background, please see our previous blog post on the AG’s Opinion here and prior press release on the oral hearing here.

The Covington team representing BSA in these cases is led by partner Lisa Peets and includes Brussels and London lawyers Kristof Van Quathem, Bart Van Vooren, and Sam Jungyun Choi. Companies with questions on the impact of today’s decision should feel free to reach out to any member of the team.

Print:
EmailTweetLikeLinkedIn
Photo of Lisa Peets Lisa Peets

Lisa Peets leads the intellectual property and technology and media groups in the firm’s London office. Ms. Peets divides her time between London and Brussels, and her practice embraces legislative advocacy, trade and IP enforcement. In this context, she has worked closely with…

Lisa Peets leads the intellectual property and technology and media groups in the firm’s London office. Ms. Peets divides her time between London and Brussels, and her practice embraces legislative advocacy, trade and IP enforcement. In this context, she has worked closely with leading multinationals in a number of sectors, including many of the world’s best-known software and hardware companies.

On behalf of her clients, Ms. Peets has been actively engaged in a wide range of law reform efforts in Europe, on multilateral, regional and national levels. This includes advocacy on EU and national initiatives relating to e-commerce, copyright, patents, data protection, technology standards, compulsory licensing, IPR enforcement and emerging technologies. Ms. Peets also counsels clients on trade related matters, including EU export controls and sanctions rules and WTO compliance.

In the IP enforcement space, Ms. Peets coordinates a team of lawyers and Internet investigators who direct civil and criminal enforcement actions in countries throughout Europe and who conduct global notice and takedown programs to combat Internet piracy.

Ms. Peets is a member of the European Commission’s Expert Group on reform of the IP Enforcement Directive.

Photo of Bart Van Vooren Bart Van Vooren

Bart Van Vooren has a broad life sciences practice supporting innovative pharmaceutical, food, medtech and biotech companies on EU regulatory, commercial and strategic policy assignments. He is widely recognized for his expertise on general EU law and procedure, as well as his extensive…

Bart Van Vooren has a broad life sciences practice supporting innovative pharmaceutical, food, medtech and biotech companies on EU regulatory, commercial and strategic policy assignments. He is widely recognized for his expertise on general EU law and procedure, as well as his extensive litigation experience before the EU Court of Justice in dozens of cases.

Over the past seven years, Mr. Van Vooren has developed a niche practice on compliance with the Biodiversity Convention and the Nagoya Protocol, a set of rules to combat bio-piracy worldwide. He has accumulated unique, practical experience in dozens of jurisdictions around the world, and has handled everything from benefit-sharing negotiations, over compliance programs, to inspections by authorities.

Finally, Mr. Van Vooren has an active pro bono practice assisting NGOs defending the human rights of persons with a disability through strategic litigation.