The CJEU's Schrems ruling on the Safe Harbour Decision

26-10-2015

On 6 October 2015, the Court of Justice of the EU (CJEU) declared invalid the European Commission's decision on the adequacy of the US data protection system (Safe Harbour Decision). In this judgment, regarding the transfer of personal data from the EU to the USA, the Court also clarified that national supervisory authorities are always allowed to investigate the lawfulness of data transfers and, if necessary, to suspend them. The case underlines the requirement for ensuring high-level protection when EU citizens' data are transferred to third countries. The implications for businesses, governments and EU institutions, as well as for EU-US relations, remain to be clarified.

On 6 October 2015, the Court of Justice of the EU (CJEU) declared invalid the European Commission's decision on the adequacy of the US data protection system (Safe Harbour Decision). In this judgment, regarding the transfer of personal data from the EU to the USA, the Court also clarified that national supervisory authorities are always allowed to investigate the lawfulness of data transfers and, if necessary, to suspend them. The case underlines the requirement for ensuring high-level protection when EU citizens' data are transferred to third countries. The implications for businesses, governments and EU institutions, as well as for EU-US relations, remain to be clarified.