{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-311-18-62018cj0311","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-311-18-62018cj0311)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-15","fingerprint":"ewai:eu:8d311e","proof":"sha256:744ad86498a4f7850f348fdb4e0e5908026aced73d7fb0346cbbbde551a30fcd","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-311-18-62018cj0311","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62018CJ0311","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Grand Chamber)","paragraphs":[]},{"title":"16 July 2020 (\n *1\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"Data Protection Commissioner","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31","para_32","para_33","para_34","para_35","para_36","para_37","para_38","para_39","para_40","para_41","para_42","para_43","para_44","para_45","para_46","para_47","para_48","para_49","para_50","para_51","para_52","para_53","para_54","para_55","para_56","para_57","para_58","para_59","para_60","para_61","para_62","para_63"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":[]},{"title":"This reference for a preliminary ruling, in essence, concerns:","paragraphs":["para_67","para_68","para_69","para_70","para_71","para_72"]},{"title":"2","paragraphs":["para_74"]},{"title":"Legal context","paragraphs":[]},{"title":"Directive 95/46","paragraphs":[]},{"title":"3","paragraphs":[]},{"title":"Article 3 of Directive 95/46, under the heading ‘Scope’, stated, in paragraph 2:","paragraphs":["para_79","para_80","para_81","para_82"]},{"title":"4","paragraphs":[]},{"title":"Article 25 of that directive provided:","paragraphs":["para_85","para_86","para_87","para_88"]},{"title":"Member States shall take the measures necessary to comply with the Commission’s Decision.’","paragraphs":[]},{"title":"5","paragraphs":[]},{"title":"Article 26(2) and (4) of the directive provided:","paragraphs":["para_92","para_93","para_94"]},{"title":"6","paragraphs":[]},{"title":"Pursuant to Article 28(3) of that directive:","paragraphs":["para_97","para_98","para_99","para_100","para_101","para_102","para_103","para_104"]},{"title":"The GDPR","paragraphs":[]},{"title":"7","paragraphs":["para_107"]},{"title":"8","paragraphs":[]},{"title":"Recitals 6, 10, 101, 103, 104, 107 to 109, 114, 116 and 141 of the GDPR state:","paragraphs":["para_110","para_111","para_112"]},{"title":"(10)","paragraphs":["para_114","para_115"]},{"title":"(101)","paragraphs":["para_117","para_118"]},{"title":"(103)","paragraphs":["para_120"]},{"title":"(104)","paragraphs":["para_122","para_123"]},{"title":"(107)","paragraphs":["para_125"]},{"title":"(108)","paragraphs":["para_127"]},{"title":"(109)","paragraphs":["para_129","para_130"]},{"title":"(114)","paragraphs":["para_132","para_133"]},{"title":"(116)","paragraphs":["para_135","para_136"]},{"title":"(141)","paragraphs":["para_138"]},{"title":"9","paragraphs":[]},{"title":"Article 2(1) and (2) of the GDPR provides:","paragraphs":["para_141"]},{"title":"2.   This Regulation does not apply to the processing of personal data:","paragraphs":[]},{"title":"(a)","paragraphs":["para_144"]},{"title":"(b)","paragraphs":["para_146"]},{"title":"(c)","paragraphs":["para_148"]},{"title":"(d)","paragraphs":["para_150"]},{"title":"10","paragraphs":[]},{"title":"Article 4 of the GDPR provides:","paragraphs":["para_153","para_154"]},{"title":"(2)","paragraphs":["para_156","para_157"]},{"title":"(7)","paragraphs":["para_159"]},{"title":"(8)","paragraphs":["para_161"]},{"title":"(9)","paragraphs":["para_163","para_164"]},{"title":"11","paragraphs":[]},{"title":"Article 23 of the GDPR states:","paragraphs":["para_167"]},{"title":"(a)","paragraphs":["para_169"]},{"title":"(b)","paragraphs":["para_171"]},{"title":"(c)","paragraphs":["para_173"]},{"title":"(d)","paragraphs":["para_175","para_176","para_177"]},{"title":"(a)","paragraphs":["para_179"]},{"title":"(b)","paragraphs":["para_181"]},{"title":"(c)","paragraphs":["para_183"]},{"title":"(d)","paragraphs":["para_185"]},{"title":"(e)","paragraphs":["para_187"]},{"title":"(f)","paragraphs":["para_189"]},{"title":"(g)","paragraphs":["para_191"]},{"title":"(h)","paragraphs":["para_193"]},{"title":"12","paragraphs":["para_195","para_196"]},{"title":"13","paragraphs":["para_198","para_199","para_200"]},{"title":"(a)","paragraphs":["para_202"]},{"title":"(b)","paragraphs":["para_204"]},{"title":"(c)","paragraphs":["para_206","para_207"]},{"title":"14","paragraphs":["para_209","para_210","para_211"]},{"title":"(a)","paragraphs":["para_213"]},{"title":"(b)","paragraphs":["para_215"]},{"title":"(c)","paragraphs":["para_217"]},{"title":"(d)","paragraphs":["para_219"]},{"title":"(e)","paragraphs":["para_221"]},{"title":"(f)","paragraphs":["para_223","para_224"]},{"title":"(a)","paragraphs":["para_226"]},{"title":"(b)","paragraphs":["para_228"]},{"title":"15","paragraphs":[]},{"title":"Article 49 of the GDPR, under the heading ‘Derogations for specific situations’, states:","paragraphs":["para_231"]},{"title":"(a)","paragraphs":["para_233"]},{"title":"(b)","paragraphs":["para_235"]},{"title":"(c)","paragraphs":["para_237"]},{"title":"(d)","paragraphs":["para_239"]},{"title":"(e)","paragraphs":["para_241"]},{"title":"(f)","paragraphs":["para_243"]},{"title":"(g)","paragraphs":["para_245","para_246","para_247","para_248","para_249","para_250","para_251"]},{"title":"16","paragraphs":[]},{"title":"Under Article 51(1) of the GDPR:","paragraphs":["para_254"]},{"title":"17","paragraphs":["para_256"]},{"title":"18","paragraphs":[]},{"title":"Article 57(1) of that regulation states as follows:","paragraphs":["para_259"]},{"title":"(a)","paragraphs":["para_261","para_262"]},{"title":"(f)","paragraphs":["para_264","para_265"]},{"title":"19","paragraphs":[]},{"title":"According to Article 58(2) and (4) of the GDPR:","paragraphs":["para_268","para_269"]},{"title":"(f)","paragraphs":["para_271","para_272"]},{"title":"(j)","paragraphs":["para_274","para_275","para_276"]},{"title":"20","paragraphs":[]},{"title":"Article 64(2) of the GDPR states:","paragraphs":["para_279"]},{"title":"21","paragraphs":[]},{"title":"Under Article 65(1) of the GDPR:","paragraphs":["para_282","para_283"]},{"title":"(c)","paragraphs":["para_285"]},{"title":"22","paragraphs":["para_287","para_288","para_289"]},{"title":"23","paragraphs":["para_291","para_292","para_293"]},{"title":"24","paragraphs":[]},{"title":"Article 94 of the GDPR provides:","paragraphs":["para_296","para_297"]},{"title":"25","paragraphs":[]},{"title":"Pursuant to Article 99 of the GDPR:","paragraphs":["para_300"]},{"title":"2.   It shall apply from 25 May 2018.’","paragraphs":[]},{"title":"The SCC Decision","paragraphs":[]},{"title":"26","paragraphs":[]},{"title":"Recital 11 of the SCC Decision reads as follows:","paragraphs":["para_305"]},{"title":"27","paragraphs":[]},{"title":"Article 1 of the SCC Decision states:","paragraphs":["para_308"]},{"title":"28","paragraphs":["para_310"]},{"title":"29","paragraphs":[]},{"title":"Article 3 of the SCC Decision provides:","paragraphs":["para_313","para_314"]},{"title":"(c)","paragraphs":["para_316"]},{"title":"(d)","paragraphs":["para_318","para_319"]},{"title":"(f)","paragraphs":["para_321","para_322"]},{"title":"30","paragraphs":["para_324","para_325"]},{"title":"(a)","paragraphs":["para_327"]},{"title":"(b)","paragraphs":["para_329"]},{"title":"(c)","paragraphs":["para_331","para_332","para_333"]},{"title":"31","paragraphs":["para_335","para_336"]},{"title":"32","paragraphs":["para_338","para_339"]},{"title":"33","paragraphs":["para_341","para_342","para_343","para_344"]},{"title":"34","paragraphs":[]},{"title":"According to Clause 4 in that annex, under the heading ‘Obligations of the data exporter’:","paragraphs":["para_347"]},{"title":"(a)","paragraphs":["para_349"]},{"title":"(b)","paragraphs":["para_351","para_352"]},{"title":"(f)","paragraphs":["para_354"]},{"title":"(g)","paragraphs":["para_356","para_357"]},{"title":"35","paragraphs":[]},{"title":"Clause 5 in that annex, under the heading ‘Obligations of the data importer …’, provides:","paragraphs":["para_360"]},{"title":"(a)","paragraphs":["para_362"]},{"title":"(b)","paragraphs":["para_364","para_365"]},{"title":"(d)","paragraphs":["para_367"]},{"title":"(i)","paragraphs":["para_369"]},{"title":"(ii)","paragraphs":["para_371"]},{"title":"(iii)","paragraphs":["para_373","para_374"]},{"title":"36","paragraphs":[]},{"title":"The footnote to the heading of Clause 5 states:","paragraphs":["para_377"]},{"title":"37","paragraphs":[]},{"title":"Clause 6 in the annex to the SCC Decision, under the heading ‘Liability’, provides:","paragraphs":["para_380","para_381","para_382"]},{"title":"38","paragraphs":["para_384","para_385"]},{"title":"39","paragraphs":["para_387"]},{"title":"40","paragraphs":[]},{"title":"According to Clause 11 in that annex, under the heading ‘Sub-processing’:","paragraphs":["para_390","para_391","para_392"]},{"title":"41","paragraphs":["para_394","para_395"]},{"title":"The Privacy Shield Decision","paragraphs":[]},{"title":"42","paragraphs":["para_398"]},{"title":"43","paragraphs":["para_400","para_401"]},{"title":"44","paragraphs":["para_403"]},{"title":"45","paragraphs":["para_405","para_406","para_407"]},{"title":"(69)","paragraphs":["para_409","para_410"]},{"title":"(76)","paragraphs":["para_412"]},{"title":"(77)","paragraphs":["para_414","para_415"]},{"title":"(109)","paragraphs":["para_417","para_418"]},{"title":"(112)","paragraphs":["para_420"]},{"title":"(113)","paragraphs":["para_422"]},{"title":"(114)","paragraphs":["para_424"]},{"title":"(115)","paragraphs":["para_426"]},{"title":"(116)","paragraphs":["para_428","para_429"]},{"title":"(120)","paragraphs":["para_431","para_432"]},{"title":"(136)","paragraphs":["para_434","para_435"]},{"title":"(140)","paragraphs":["para_437"]},{"title":"46","paragraphs":[]},{"title":"Under Article 1 of the Privacy Shield Decision:","paragraphs":["para_440","para_441","para_442"]},{"title":"47","paragraphs":["para_444"]},{"title":"48","paragraphs":["para_446","para_447","para_448","para_449","para_450","para_451","para_452","para_453"]},{"title":"49","paragraphs":["para_455"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"50","paragraphs":["para_458"]},{"title":"51","paragraphs":["para_460"]},{"title":"52","paragraphs":["para_462"]},{"title":"53","paragraphs":["para_464"]},{"title":"54","paragraphs":["para_466"]},{"title":"55","paragraphs":["para_468"]},{"title":"56","paragraphs":["para_470"]},{"title":"57","paragraphs":["para_472"]},{"title":"58","paragraphs":["para_474"]},{"title":"59","paragraphs":["para_476"]},{"title":"60","paragraphs":["para_478"]},{"title":"61","paragraphs":["para_480"]},{"title":"62","paragraphs":["para_482"]},{"title":"63","paragraphs":["para_484"]},{"title":"64","paragraphs":["para_486"]},{"title":"65","paragraphs":["para_488"]},{"title":"66","paragraphs":["para_490"]},{"title":"67","paragraphs":["para_492"]},{"title":"68","paragraphs":["para_494"]},{"title":"(1)","paragraphs":["para_496"]},{"title":"(2)","paragraphs":[]},{"title":"(a)","paragraphs":["para_499"]},{"title":"(i)","paragraphs":["para_501"]},{"title":"(ii)","paragraphs":["para_503"]},{"title":"(b)","paragraphs":["para_505"]},{"title":"(3)","paragraphs":["para_507"]},{"title":"(a)","paragraphs":["para_509","para_510"]},{"title":"(b)","paragraphs":["para_512"]},{"title":"(4)","paragraphs":["para_514"]},{"title":"(5)","paragraphs":["para_516"]},{"title":"(a)","paragraphs":["para_518"]},{"title":"If the answer to Question 5(a) is in the affirmative:","paragraphs":[]},{"title":"(b)","paragraphs":["para_521"]},{"title":"(6)","paragraphs":[]},{"title":"(a)","paragraphs":["para_524"]},{"title":"(b)","paragraphs":["para_526"]},{"title":"(7)","paragraphs":["para_528"]},{"title":"(8)","paragraphs":["para_530"]},{"title":"(9)","paragraphs":[]},{"title":"(a)","paragraphs":["para_533"]},{"title":"(b)","paragraphs":["para_535"]},{"title":"(10)","paragraphs":["para_537"]},{"title":"(11)","paragraphs":[]},{"title":"Does the [SCC Decision] violate Articles 7, 8 and/or 47 of the Charter?’","paragraphs":[]},{"title":"Admissibility of the request for a preliminary ruling","paragraphs":[]},{"title":"69","paragraphs":["para_542"]},{"title":"70","paragraphs":["para_544"]},{"title":"71","paragraphs":["para_546"]},{"title":"72","paragraphs":["para_548"]},{"title":"73","paragraphs":["para_550"]},{"title":"74","paragraphs":["para_552"]},{"title":"75","paragraphs":["para_554"]},{"title":"76","paragraphs":["para_556"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"77","paragraphs":["para_559"]},{"title":"78","paragraphs":["para_561"]},{"title":"79","paragraphs":["para_563"]},{"title":"The first question","paragraphs":[]},{"title":"80","paragraphs":["para_566"]},{"title":"81","paragraphs":["para_568"]},{"title":"82","paragraphs":["para_570"]},{"title":"83","paragraphs":["para_572"]},{"title":"84","paragraphs":["para_574"]},{"title":"85","paragraphs":["para_576"]},{"title":"86","paragraphs":["para_578"]},{"title":"87","paragraphs":["para_580"]},{"title":"88","paragraphs":["para_582"]},{"title":"89","paragraphs":["para_584"]},{"title":"The second, third and sixth questions","paragraphs":[]},{"title":"90","paragraphs":["para_587"]},{"title":"91","paragraphs":["para_589"]},{"title":"92","paragraphs":["para_591"]},{"title":"93","paragraphs":["para_593"]},{"title":"94","paragraphs":["para_595"]},{"title":"95","paragraphs":["para_597"]},{"title":"96","paragraphs":["para_599"]},{"title":"97","paragraphs":["para_601"]},{"title":"98","paragraphs":["para_603"]},{"title":"99","paragraphs":["para_605"]},{"title":"100","paragraphs":["para_607"]},{"title":"101","paragraphs":["para_609"]},{"title":"102","paragraphs":["para_611"]},{"title":"103","paragraphs":["para_613"]},{"title":"104","paragraphs":["para_615"]},{"title":"105","paragraphs":["para_617"]},{"title":"The eighth question","paragraphs":[]},{"title":"106","paragraphs":["para_620"]},{"title":"107","paragraphs":["para_622"]},{"title":"108","paragraphs":["para_624"]},{"title":"109","paragraphs":["para_626"]},{"title":"110","paragraphs":["para_628"]},{"title":"111","paragraphs":["para_630"]},{"title":"112","paragraphs":["para_632"]},{"title":"113","paragraphs":["para_634"]},{"title":"114","paragraphs":["para_636"]},{"title":"115","paragraphs":["para_638"]},{"title":"116","paragraphs":["para_640"]},{"title":"117","paragraphs":["para_642"]},{"title":"118","paragraphs":["para_644"]},{"title":"119","paragraphs":["para_646"]},{"title":"120","paragraphs":["para_648"]},{"title":"121","paragraphs":["para_650"]},{"title":"The7th and 11th questions","paragraphs":[]},{"title":"122","paragraphs":["para_653"]},{"title":"123","paragraphs":["para_655"]},{"title":"124","paragraphs":["para_657"]},{"title":"125","paragraphs":["para_659"]},{"title":"126","paragraphs":["para_661"]},{"title":"127","paragraphs":["para_663"]},{"title":"128","paragraphs":["para_665"]},{"title":"129","paragraphs":["para_667"]},{"title":"130","paragraphs":["para_669"]},{"title":"131","paragraphs":["para_671"]},{"title":"132","paragraphs":["para_673"]},{"title":"133","paragraphs":["para_675"]},{"title":"134","paragraphs":["para_677"]},{"title":"135","paragraphs":["para_679"]},{"title":"136","paragraphs":["para_681"]},{"title":"137","paragraphs":["para_683"]},{"title":"138","paragraphs":["para_685"]},{"title":"139","paragraphs":["para_687"]},{"title":"140","paragraphs":["para_689"]},{"title":"141","paragraphs":["para_691"]},{"title":"142","paragraphs":["para_693"]},{"title":"143","paragraphs":["para_695"]},{"title":"144","paragraphs":["para_697"]},{"title":"145","paragraphs":["para_699"]},{"title":"146","paragraphs":["para_701"]},{"title":"147","paragraphs":["para_703"]},{"title":"148","paragraphs":["para_705"]},{"title":"149","paragraphs":["para_707"]},{"title":"The 4th, 5th, 9th and 10th questions","paragraphs":[]},{"title":"150","paragraphs":["para_710"]},{"title":"151","paragraphs":["para_712"]},{"title":"152","paragraphs":["para_714"]},{"title":"153","paragraphs":["para_716"]},{"title":"154","paragraphs":["para_718"]},{"title":"155","paragraphs":["para_720"]},{"title":"156","paragraphs":["para_722"]},{"title":"157","paragraphs":["para_724"]},{"title":"158","paragraphs":["para_726"]},{"title":"159","paragraphs":["para_728"]},{"title":"160","paragraphs":["para_730"]},{"title":"161","paragraphs":["para_732"]},{"title":"162","paragraphs":["para_734"]},{"title":"The Privacy Shield Decision","paragraphs":[]},{"title":"163","paragraphs":["para_737"]},{"title":"164","paragraphs":["para_739"]},{"title":"165","paragraphs":["para_741"]},{"title":"166","paragraphs":["para_743"]},{"title":"167","paragraphs":["para_745"]},{"title":"The finding of an adequate level of protection","paragraphs":[]},{"title":"168","paragraphs":["para_748"]},{"title":"169","paragraphs":["para_750"]},{"title":"170","paragraphs":["para_752"]},{"title":"171","paragraphs":["para_754"]},{"title":"172","paragraphs":["para_756"]},{"title":"173","paragraphs":["para_758"]},{"title":"174","paragraphs":["para_760"]},{"title":"175","paragraphs":["para_762"]},{"title":"176","paragraphs":["para_764"]},{"title":"177","paragraphs":["para_766"]},{"title":"178","paragraphs":["para_768"]},{"title":"179","paragraphs":["para_770"]},{"title":"180","paragraphs":["para_772"]},{"title":"181","paragraphs":["para_774"]},{"title":"182","paragraphs":["para_776"]},{"title":"183","paragraphs":["para_778"]},{"title":"184","paragraphs":["para_780"]},{"title":"185","paragraphs":["para_782"]},{"title":"186","paragraphs":["para_784"]},{"title":"187","paragraphs":["para_786"]},{"title":"188","paragraphs":["para_788"]},{"title":"189","paragraphs":["para_790"]},{"title":"190","paragraphs":["para_792"]},{"title":"191","paragraphs":["para_794"]},{"title":"192","paragraphs":["para_796"]},{"title":"193","paragraphs":["para_798"]},{"title":"194","paragraphs":["para_800"]},{"title":"195","paragraphs":["para_802"]},{"title":"196","paragraphs":["para_804"]},{"title":"197","paragraphs":["para_806"]},{"title":"198","paragraphs":["para_808"]},{"title":"199","paragraphs":["para_810"]},{"title":"200","paragraphs":["para_812"]},{"title":"201","paragraphs":["para_814"]},{"title":"202","paragraphs":["para_816"]},{"title":"Costs","paragraphs":[]},{"title":"203","paragraphs":["para_819"]},{"title":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraphs":["para_821","para_822","para_823","para_824","para_825","para_826","para_827","para_828","para_829","para_830"]},{"title":"Lenaerts","paragraphs":[]},{"title":"Silva de Lapuerta","paragraphs":[]},{"title":"Arabadjiev","paragraphs":[]},{"title":"Prechal","paragraphs":[]},{"title":"Vilaras","paragraphs":[]},{"title":"Safjan","paragraphs":[]},{"title":"Rodin","paragraphs":[]},{"title":"Xuereb","paragraphs":[]},{"title":"Rossi","paragraphs":[]},{"title":"Jarukaitis","paragraphs":[]},{"title":"Ilešič","paragraphs":["para_842","para_843","para_844"]},{"title":"A. Calot Escobar","paragraphs":[]},{"title":"Registrar","paragraphs":[]},{"title":"K. Lenaerts","paragraphs":[]},{"title":"President","paragraphs":["para_849"]}],"paragraphs":[{"text":"62018CJ0311","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Grand Chamber)","paragraph_id":"para_2"},{"text":"16 July 2020 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Charter of Fundamental Rights of the European Union — Articles 7, 8 and 47 — Regulation (EU) 2016/679 — Article 2(2) — Scope — Transfers of personal data to third countries for commercial …","paragraph_id":"para_4"},{"text":"In Case C‑311/18,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the High Court (Ireland), made by decision of 4 May 2018, received at the Court on 9 May 2018, in the proceedings","paragraph_id":"para_6"},{"text":"Data Protection Commissioner","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Facebook Ireland Ltd,","paragraph_id":"para_9"},{"text":"Maximillian Schrems,","paragraph_id":"para_10"},{"text":"intervening parties:","paragraph_id":"para_11"},{"text":"The United States of America,","paragraph_id":"para_12"},{"text":"Electronic Privacy Information Centre,","paragraph_id":"para_13"},{"text":"BSA Business Software Alliance Inc.,","paragraph_id":"para_14"},{"text":"Digitaleurope,","paragraph_id":"para_15"},{"text":"THE COURT (Grand Chamber),","paragraph_id":"para_16"},{"text":"composed of K. Lenaerts, President, R. Silva de Lapuerta, Vice-President, A. Arabadjiev, A. Prechal, M. Vilaras, M. Safjan, S. Rodin, P.G. Xuereb, L.S. Rossi and I. Jarukaitis, Presidents of Chambers, M. Ilešič, T. von Danwitz (Rapporteur), and D. Šváby, Judges,","paragraph_id":"para_17"},{"text":"Advocate General: H. Saugmandsgaard Øe,","paragraph_id":"para_18"},{"text":"Registrar: C. Strömholm, Administrator,","paragraph_id":"para_19"},{"text":"having regard to the written procedure and further to the hearing on 9 July 2019,","paragraph_id":"para_20"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the Data Protection Commissioner, by D. Young, Solicitor, B. Murray and M. Collins, Senior Counsel, and C. Donnelly, Barrister-at-Law,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"Facebook Ireland Ltd, by P. Gallagher and N. Hyland, Senior Counsel, A. Mulligan and F. Kieran, Barristers-at-Law, and P. Nolan, C. Monaghan, C. O’Neill and R. Woulfe, Solicitors,","paragraph_id":"para_25"},{"text":"–","paragraph_id":"para_26"},{"text":"Mr Schrems, by H. Hofmann, Rechtsanwalt, E. McCullough, J. Doherty and S. O’Sullivan, Senior Counsel, and G. Rudden, Solicitor,","paragraph_id":"para_27"},{"text":"–","paragraph_id":"para_28"},{"text":"the United States of America, by E. Barrington, Senior Counsel, S. Kingston, Barrister-at-Law, S. Barton and B. Walsh, Solicitors,","paragraph_id":"para_29"},{"text":"–","paragraph_id":"para_30"},{"text":"the Electronic Privacy Information Centre, by S. Lucey, Solicitor, G. Gilmore and A. Butler, Barristers-at-Law, and C. O’Dwyer, Senior Counsel,","paragraph_id":"para_31"},{"text":"–","paragraph_id":"para_32"},{"text":"BSA Business Software Alliance Inc., by B. Van Vooren and K. Van Quathem, advocaten,","paragraph_id":"para_33"},{"text":"–","paragraph_id":"para_34"},{"text":"Digitaleurope, by N. Cahill, Barrister, J. Cahir, Solicitor, and M. Cush, Senior Counsel,","paragraph_id":"para_35"},{"text":"–","paragraph_id":"para_36"},{"text":"Ireland, by A. Joyce and M. Browne, acting as Agents, and D. Fennelly, Barrister-at-Law,","paragraph_id":"para_37"},{"text":"–","paragraph_id":"para_38"},{"text":"the Belgian Government, by J.‑C. Halleux and P. Cottin, acting as Agents,","paragraph_id":"para_39"},{"text":"–","paragraph_id":"para_40"},{"text":"the Czech Government, by M. Smolek, J. Vláčil, O. Serdula and A. Kasalická, acting as Agents,","paragraph_id":"para_41"},{"text":"–","paragraph_id":"para_42"},{"text":"the German Government, by J. Möller, D. Klebs and T. Henze, acting as Agents,","paragraph_id":"para_43"},{"text":"–","paragraph_id":"para_44"},{"text":"the French Government, by A.-L. Desjonquères, acting as Agent,","paragraph_id":"para_45"},{"text":"–","paragraph_id":"para_46"},{"text":"the Netherlands Government, by C.S. Schillemans, M.K. Bulterman and M. Noort, acting as Agents,","paragraph_id":"para_47"},{"text":"–","paragraph_id":"para_48"},{"text":"the Austrian Government, by J. Schmoll and G. Kunnert, acting as Agents,","paragraph_id":"para_49"},{"text":"–","paragraph_id":"para_50"},{"text":"the Polish Government, by B. Majczyna, acting as Agent,","paragraph_id":"para_51"},{"text":"–","paragraph_id":"para_52"},{"text":"the Portuguese Government, by L. Inez Fernandes, A. Pimenta and C. Vieira Guerra, acting as Agents,","paragraph_id":"para_53"},{"text":"–","paragraph_id":"para_54"},{"text":"the United Kingdom Government, by S. Brandon, acting as Agent, and J. Holmes QC, and C. Knight, Barrister,","paragraph_id":"para_55"},{"text":"–","paragraph_id":"para_56"},{"text":"the European Parliament, by M.J. Martínez Iglesias and A. Caiola, acting as Agents,","paragraph_id":"para_57"},{"text":"–","paragraph_id":"para_58"},{"text":"the European Commission, by D. Nardi, H. Krämer and H. Kranenborg, acting as Agents,","paragraph_id":"para_59"},{"text":"–","paragraph_id":"para_60"},{"text":"the European Data Protection Board (EDPB), by A. Jelinek and K. Behn, acting as Agents,","paragraph_id":"para_61"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 19 December 2019,","paragraph_id":"para_62"},{"text":"gives the following","paragraph_id":"para_63"},{"text":"Judgment","paragraph_id":"para_64"},{"text":"1","paragraph_id":"para_65"},{"text":"This reference for a preliminary ruling, in essence, concerns:","paragraph_id":"para_66"},{"text":"–","paragraph_id":"para_67"},{"text":"the interpretation of the first indent of Article 3(2), Articles 25 and 26 and Article 28(3) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 ), read in the light of Article 4(2) TEU and of Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’);","paragraph_id":"para_68"},{"text":"–","paragraph_id":"para_69"},{"text":"the interpretation and validity of Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46 ( OJ 2010 L 39, p. 5 ), as amended by Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 ( OJ 2016 L 344, p. 100 ) (‘the SCC Decision’); and","paragraph_id":"para_70"},{"text":"–","paragraph_id":"para_71"},{"text":"the interpretation and validity of Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46 on the adequacy of the protection provided by the EU-US Privacy Shield ( OJ 2016 L 207, p. 1 ; ‘the Privacy Shield Decision’).","paragraph_id":"para_72"},{"text":"2","paragraph_id":"para_73"},{"text":"The request has been made in proceedings between the Data Protection Commissioner (Ireland) (‘the Commissioner’), on the one hand, and Facebook Ireland Ltd and Maximillian Schrems, on the other, concerning a complaint brought by Mr Schrems concerning the transfer of his personal data by Facebook Ireland to Facebook Inc. in the United States.","paragraph_id":"para_74"},{"text":"Legal context","paragraph_id":"para_75"},{"text":"Directive 95/46","paragraph_id":"para_76"},{"text":"3","paragraph_id":"para_77"},{"text":"Article 3 of Directive 95/46, under the heading ‘Scope’, stated, in paragraph 2:","paragraph_id":"para_78"},{"text":"‘This Directive shall not apply to the processing of personal data:","paragraph_id":"para_79"},{"text":"–","paragraph_id":"para_80"},{"text":"in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,","paragraph_id":"para_81"},{"text":"– …’","paragraph_id":"para_82"},{"text":"4","paragraph_id":"para_83"},{"text":"Article 25 of that directive provided:","paragraph_id":"para_84"},{"text":"‘1.   The Member States shall provide that the transfer to a third country of personal data … may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.","paragraph_id":"para_85"},{"text":"2.   The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; …","paragraph_id":"para_86"},{"text":"…","paragraph_id":"para_87"},{"text":"6.   The Commission may find, in accordance with the procedure referred to in Article 31(2), that a third country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.","paragraph_id":"para_88"},{"text":"Member States shall take the measures necessary to comply with the Commission’s Decision.’","paragraph_id":"para_89"},{"text":"5","paragraph_id":"para_90"},{"text":"Article 26(2) and (4) of the directive provided:","paragraph_id":"para_91"},{"text":"‘2.   Without prejudice to paragraph 1, a Member State may authorise a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25(2), where the controller adduces adequate safeguards with respect to the pr …","paragraph_id":"para_92"},{"text":"…","paragraph_id":"para_93"},{"text":"4.   Where the Commission decides, in accordance with the procedure referred to in Article 31(2), that certain standard contractual clauses offer sufficient safeguards as required by paragraph 2, Member States shall take the necessary measures to comply with the Commission’s decision.’","paragraph_id":"para_94"},{"text":"6","paragraph_id":"para_95"},{"text":"Pursuant to Article 28(3) of that directive:","paragraph_id":"para_96"},{"text":"‘Each authority shall in particular be endowed with:","paragraph_id":"para_97"},{"text":"–","paragraph_id":"para_98"},{"text":"investigative powers, such as powers of access to data forming the subject matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,","paragraph_id":"para_99"},{"text":"–","paragraph_id":"para_100"},{"text":"effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,","paragraph_id":"para_101"},{"text":"–","paragraph_id":"para_102"},{"text":"the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been infringed or to bring those infringements to the attention of the judicial authorities.","paragraph_id":"para_103"},{"text":"…’","paragraph_id":"para_104"},{"text":"The GDPR","paragraph_id":"para_105"},{"text":"7","paragraph_id":"para_106"},{"text":"Directive 95/46 was repealed and replaced by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation) ( OJ 2016 L 119, p. 1 ; ‘the GDPR’).","paragraph_id":"para_107"},{"text":"8","paragraph_id":"para_108"},{"text":"Recitals 6, 10, 101, 103, 104, 107 to 109, 114, 116 and 141 of the GDPR state:","paragraph_id":"para_109"},{"text":"‘(6)","paragraph_id":"para_110"},{"text":"Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sharing of personal data has increased significantly. Technology allows both private companies and public authorities to make use of personal data on an …","paragraph_id":"para_111"},{"text":"…","paragraph_id":"para_112"},{"text":"(10)","paragraph_id":"para_113"},{"text":"In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member …","paragraph_id":"para_114"},{"text":"…","paragraph_id":"para_115"},{"text":"(101)","paragraph_id":"para_116"},{"text":"Flows of personal data to and from countries outside the Union and international organisations are necessary for the expansion of international trade and international cooperation. The increase in these flows has raised new challenges and concerns with regard to the protection of personal data. Howe …","paragraph_id":"para_117"},{"text":"…","paragraph_id":"para_118"},{"text":"(103)","paragraph_id":"para_119"},{"text":"The Commission may decide with effect for the entire Union that a third country, a territory or specified sector within a third country, or an international organisation, offers an adequate level of data protection, thus providing legal certainty and uniformity throughout the Union as regards the th …","paragraph_id":"para_120"},{"text":"(104)","paragraph_id":"para_121"},{"text":"In line with the fundamental values on which the Union is founded, in particular the protection of human rights, the Commission should, in its assessment of the third country, or of a territory or specified sector within a third country, take into account how a particular third country respects the …","paragraph_id":"para_122"},{"text":"…","paragraph_id":"para_123"},{"text":"(107)","paragraph_id":"para_124"},{"text":"The Commission may recognise that a third country, a territory or a specified sector within a third country, or an international organisation no longer ensures an adequate level of data protection. Consequently the transfer of personal data to that third country or international organisation should …","paragraph_id":"para_125"},{"text":"(108)","paragraph_id":"para_126"},{"text":"In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject. Such appropriate safeguards may consist of making use of binding corporate rules, standard …","paragraph_id":"para_127"},{"text":"(109)","paragraph_id":"para_128"},{"text":"The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should prevent controllers or processors neither from including the standard data-protection clauses in a wider contract, such as a contract between the pro …","paragraph_id":"para_129"},{"text":"…","paragraph_id":"para_130"},{"text":"(114)","paragraph_id":"para_131"},{"text":"In any case, where the Commission has taken no decision on the adequate level of data protection in a third country, the controller or processor should make use of solutions that provide data subjects with enforceable and effective rights as regards the processing of their data in the Union once those data have been transferred so that that they will continue to benefit from fundamental rights and safeguards.","paragraph_id":"para_132"},{"text":"…","paragraph_id":"para_133"},{"text":"(116)","paragraph_id":"para_134"},{"text":"When personal data moves across borders outside the Union it may put at increased risk the ability of natural persons to exercise data protection rights in particular to protect themselves from the unlawful use or disclosure of that information. At the same time, supervisory authorities may find tha …","paragraph_id":"para_135"},{"text":"…","paragraph_id":"para_136"},{"text":"(141)","paragraph_id":"para_137"},{"text":"Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or …","paragraph_id":"para_138"},{"text":"9","paragraph_id":"para_139"},{"text":"Article 2(1) and (2) of the GDPR provides:","paragraph_id":"para_140"},{"text":"‘1.   This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.","paragraph_id":"para_141"},{"text":"2.   This Regulation does not apply to the processing of personal data:","paragraph_id":"para_142"},{"text":"(a)","paragraph_id":"para_143"},{"text":"in the course of an activity which falls outside the scope of Union law;","paragraph_id":"para_144"},{"text":"(b)","paragraph_id":"para_145"},{"text":"by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;","paragraph_id":"para_146"},{"text":"(c)","paragraph_id":"para_147"},{"text":"by a natural person in the course of a purely personal or household activity;","paragraph_id":"para_148"},{"text":"(d)","paragraph_id":"para_149"},{"text":"by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’","paragraph_id":"para_150"},{"text":"10","paragraph_id":"para_151"},{"text":"Article 4 of the GDPR provides:","paragraph_id":"para_152"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_153"},{"text":"…","paragraph_id":"para_154"},{"text":"(2)","paragraph_id":"para_155"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_156"},{"text":"…","paragraph_id":"para_157"},{"text":"(7)","paragraph_id":"para_158"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;","paragraph_id":"para_159"},{"text":"(8)","paragraph_id":"para_160"},{"text":"“processor”, means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;","paragraph_id":"para_161"},{"text":"(9)","paragraph_id":"para_162"},{"text":"“recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State …","paragraph_id":"para_163"},{"text":"…’","paragraph_id":"para_164"},{"text":"11","paragraph_id":"para_165"},{"text":"Article 23 of the GDPR states:","paragraph_id":"para_166"},{"text":"‘1.   Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and ob …","paragraph_id":"para_167"},{"text":"(a)","paragraph_id":"para_168"},{"text":"national security;","paragraph_id":"para_169"},{"text":"(b)","paragraph_id":"para_170"},{"text":"defence;","paragraph_id":"para_171"},{"text":"(c)","paragraph_id":"para_172"},{"text":"public security;","paragraph_id":"para_173"},{"text":"(d)","paragraph_id":"para_174"},{"text":"the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;","paragraph_id":"para_175"},{"text":"…","paragraph_id":"para_176"},{"text":"2.   In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:","paragraph_id":"para_177"},{"text":"(a)","paragraph_id":"para_178"},{"text":"the purposes of the processing or categories of processing;","paragraph_id":"para_179"},{"text":"(b)","paragraph_id":"para_180"},{"text":"the categories of personal data;","paragraph_id":"para_181"},{"text":"(c)","paragraph_id":"para_182"},{"text":"the scope of the restrictions introduced;","paragraph_id":"para_183"},{"text":"(d)","paragraph_id":"para_184"},{"text":"the safeguards to prevent abuse or unlawful access or transfer;","paragraph_id":"para_185"},{"text":"(e)","paragraph_id":"para_186"},{"text":"the specification of the controller or categories of controllers;","paragraph_id":"para_187"},{"text":"(f)","paragraph_id":"para_188"},{"text":"the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;","paragraph_id":"para_189"},{"text":"(g)","paragraph_id":"para_190"},{"text":"the risks to the rights and freedoms of data subjects; and","paragraph_id":"para_191"},{"text":"(h)","paragraph_id":"para_192"},{"text":"the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.’","paragraph_id":"para_193"},{"text":"12","paragraph_id":"para_194"},{"text":"Chapter V of the GDPR, under the heading ‘Transfers of personal data to third countries or international organisations’, contains Articles 44 to 50 of that regulation. According to Article 44 thereof, under the heading ‘General principle for transfers’:","paragraph_id":"para_195"},{"text":"‘Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with …","paragraph_id":"para_196"},{"text":"13","paragraph_id":"para_197"},{"text":"Article 45 of the GDPR, under the heading ‘Transfers on the basis of an adequacy decision’, provides, in paragraphs 1 to 3:","paragraph_id":"para_198"},{"text":"‘1.   A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.","paragraph_id":"para_199"},{"text":"2.   When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements:","paragraph_id":"para_200"},{"text":"(a)","paragraph_id":"para_201"},{"text":"the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislat …","paragraph_id":"para_202"},{"text":"(b)","paragraph_id":"para_203"},{"text":"the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and","paragraph_id":"para_204"},{"text":"(c)","paragraph_id":"para_205"},{"text":"the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.","paragraph_id":"para_206"},{"text":"3.   The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meani …","paragraph_id":"para_207"},{"text":"14","paragraph_id":"para_208"},{"text":"Article 46 of the GDPR, under the heading ‘Transfers subject to appropriate safeguards’, provides, in paragraphs 1 to 3:","paragraph_id":"para_209"},{"text":"‘1.   In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.","paragraph_id":"para_210"},{"text":"2.   The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:","paragraph_id":"para_211"},{"text":"(a)","paragraph_id":"para_212"},{"text":"a legally binding and enforceable instrument between public authorities or bodies;","paragraph_id":"para_213"},{"text":"(b)","paragraph_id":"para_214"},{"text":"binding corporate rules in accordance with Article 47;","paragraph_id":"para_215"},{"text":"(c)","paragraph_id":"para_216"},{"text":"standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);","paragraph_id":"para_217"},{"text":"(d)","paragraph_id":"para_218"},{"text":"standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);","paragraph_id":"para_219"},{"text":"(e)","paragraph_id":"para_220"},{"text":"an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or","paragraph_id":"para_221"},{"text":"(f)","paragraph_id":"para_222"},{"text":"an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights.","paragraph_id":"para_223"},{"text":"3.   Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:","paragraph_id":"para_224"},{"text":"(a)","paragraph_id":"para_225"},{"text":"contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or","paragraph_id":"para_226"},{"text":"(b)","paragraph_id":"para_227"},{"text":"provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.’","paragraph_id":"para_228"},{"text":"15","paragraph_id":"para_229"},{"text":"Article 49 of the GDPR, under the heading ‘Derogations for specific situations’, states:","paragraph_id":"para_230"},{"text":"‘1.   In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:","paragraph_id":"para_231"},{"text":"(a)","paragraph_id":"para_232"},{"text":"the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;","paragraph_id":"para_233"},{"text":"(b)","paragraph_id":"para_234"},{"text":"the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request;","paragraph_id":"para_235"},{"text":"(c)","paragraph_id":"para_236"},{"text":"the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;","paragraph_id":"para_237"},{"text":"(d)","paragraph_id":"para_238"},{"text":"the transfer is necessary for important reasons of public interest;","paragraph_id":"para_239"},{"text":"(e)","paragraph_id":"para_240"},{"text":"the transfer is necessary for the establishment, exercise or defence of legal claims;","paragraph_id":"para_241"},{"text":"(f)","paragraph_id":"para_242"},{"text":"the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;","paragraph_id":"para_243"},{"text":"(g)","paragraph_id":"para_244"},{"text":"the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case.","paragraph_id":"para_245"},{"text":"Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international o …","paragraph_id":"para_246"},{"text":"2.   A transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the entirety of the personal data or entire categories of the personal data contained in the register. Where the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients.","paragraph_id":"para_247"},{"text":"3.   Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph thereof shall not apply to activities carried out by public authorities in the exercise of their public powers.","paragraph_id":"para_248"},{"text":"4.   The public interest referred to in point (d) of the first subparagraph of paragraph 1 shall be recognised in Union law or in the law of the Member State to which the controller is subject.","paragraph_id":"para_249"},{"text":"5.   In the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of personal data to a third country or an international organisation. Member States shall notify such provisions to the Commission.","paragraph_id":"para_250"},{"text":"6.   The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records referred to in Article 30.’","paragraph_id":"para_251"},{"text":"16","paragraph_id":"para_252"},{"text":"Under Article 51(1) of the GDPR:","paragraph_id":"para_253"},{"text":"‘Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (“supervisory authority”).’","paragraph_id":"para_254"},{"text":"17","paragraph_id":"para_255"},{"text":"In accordance with Article 55(1) of the GDPR, ‘each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State’.","paragraph_id":"para_256"},{"text":"18","paragraph_id":"para_257"},{"text":"Article 57(1) of that regulation states as follows:","paragraph_id":"para_258"},{"text":"‘Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:","paragraph_id":"para_259"},{"text":"(a)","paragraph_id":"para_260"},{"text":"monitor and enforce the application of this Regulation;","paragraph_id":"para_261"},{"text":"…","paragraph_id":"para_262"},{"text":"(f)","paragraph_id":"para_263"},{"text":"handle complaints lodged by a data subject … and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;","paragraph_id":"para_264"},{"text":"…’","paragraph_id":"para_265"},{"text":"19","paragraph_id":"para_266"},{"text":"According to Article 58(2) and (4) of the GDPR:","paragraph_id":"para_267"},{"text":"‘2.   Each supervisory authority shall have all of the following corrective powers:","paragraph_id":"para_268"},{"text":"…","paragraph_id":"para_269"},{"text":"(f)","paragraph_id":"para_270"},{"text":"to impose a temporary or definitive limitation including a ban on processing;","paragraph_id":"para_271"},{"text":"…","paragraph_id":"para_272"},{"text":"(j)","paragraph_id":"para_273"},{"text":"to order the suspension of data flows to a recipient in a third country or to an international organisation.","paragraph_id":"para_274"},{"text":"…","paragraph_id":"para_275"},{"text":"4.   The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.’","paragraph_id":"para_276"},{"text":"20","paragraph_id":"para_277"},{"text":"Article 64(2) of the GDPR states:","paragraph_id":"para_278"},{"text":"‘Any supervisory authority, the Chair of the [European Data Protection Board (EDPB)] or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62.’","paragraph_id":"para_279"},{"text":"21","paragraph_id":"para_280"},{"text":"Under Article 65(1) of the GDPR:","paragraph_id":"para_281"},{"text":"‘In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases:","paragraph_id":"para_282"},{"text":"…","paragraph_id":"para_283"},{"text":"(c)","paragraph_id":"para_284"},{"text":"where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board.’","paragraph_id":"para_285"},{"text":"22","paragraph_id":"para_286"},{"text":"Article 77 of the GDPR, under the heading ‘Right to lodge a complaint with a supervisory authority’, states:","paragraph_id":"para_287"},{"text":"‘1.   Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.","paragraph_id":"para_288"},{"text":"2.   The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.’","paragraph_id":"para_289"},{"text":"23","paragraph_id":"para_290"},{"text":"Article 78 of the GDPR, under the heading ‘Right to an effective judicial remedy against a supervisory authority’, provides, in paragraphs 1 and 2:","paragraph_id":"para_291"},{"text":"‘1.   Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.","paragraph_id":"para_292"},{"text":"2.   Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to [an] effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.’","paragraph_id":"para_293"},{"text":"24","paragraph_id":"para_294"},{"text":"Article 94 of the GDPR provides:","paragraph_id":"para_295"},{"text":"‘1.   Directive [95/46] is repealed with effect from 25 May 2018.","paragraph_id":"para_296"},{"text":"2.   References to the repealed Directive shall be construed as references to this Regulation. References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive [95/46] shall be construed as references to the European Data Protection Board established by this Regulation.’","paragraph_id":"para_297"},{"text":"25","paragraph_id":"para_298"},{"text":"Pursuant to Article 99 of the GDPR:","paragraph_id":"para_299"},{"text":"‘1.   This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .","paragraph_id":"para_300"},{"text":"2.   It shall apply from 25 May 2018.’","paragraph_id":"para_301"},{"text":"The SCC Decision","paragraph_id":"para_302"},{"text":"26","paragraph_id":"para_303"},{"text":"Recital 11 of the SCC Decision reads as follows:","paragraph_id":"para_304"},{"text":"‘Supervisory authorities of the Member States play a key role in this contractual mechanism in ensuring that personal data are adequately protected after the transfer. In exceptional cases where data exporters refuse or are unable to instruct the data importer properly, with an imminent risk of grav …","paragraph_id":"para_305"},{"text":"27","paragraph_id":"para_306"},{"text":"Article 1 of the SCC Decision states:","paragraph_id":"para_307"},{"text":"‘The standard contractual clauses set out in the Annex are considered as offering adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights as required by Article 26(2) of Directive [95/46].’","paragraph_id":"para_308"},{"text":"28","paragraph_id":"para_309"},{"text":"In accordance with the second paragraph of Article 2 of the SCC Decision, that decision ‘shall apply to the transfer of personal data by controllers established in the European Union to recipients established outside the territory of the European Union who act only as data processors’.","paragraph_id":"para_310"},{"text":"29","paragraph_id":"para_311"},{"text":"Article 3 of the SCC Decision provides:","paragraph_id":"para_312"},{"text":"‘For the purposes of this Decision, the following definitions shall apply:","paragraph_id":"para_313"},{"text":"…","paragraph_id":"para_314"},{"text":"(c)","paragraph_id":"para_315"},{"text":"“data exporter” means the controller who transfers the personal data;","paragraph_id":"para_316"},{"text":"(d)","paragraph_id":"para_317"},{"text":"“data importer” means the processor established in a third country who agrees to receive from the data exporter personal data intended for processing on the data exporter’s behalf after the transfer in accordance with his instructions and the terms of this Decision and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of Directive [95/46];","paragraph_id":"para_318"},{"text":"…","paragraph_id":"para_319"},{"text":"(f)","paragraph_id":"para_320"},{"text":"“applicable data protection law” means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;","paragraph_id":"para_321"},{"text":"…’","paragraph_id":"para_322"},{"text":"30","paragraph_id":"para_323"},{"text":"According to its original wording, prior to the entry into force of Implementing Decision 2016/2297, Article 4 of Decision 2010/87 provided:","paragraph_id":"para_324"},{"text":"‘1.   ‘Without prejudice to their powers to take action to ensure compliance with national provisions adopted pursuant to Chapters II, III, V and VI of Directive [95/46], the competent authorities in the Member States may exercise their existing powers to prohibit or suspend data flows to third countries in order to protect individuals with regard to the processing of their personal data in cases where:","paragraph_id":"para_325"},{"text":"(a)","paragraph_id":"para_326"},{"text":"it is established that the law to which the data importer or a sub-processor is subject imposes upon him requirements to derogate from the applicable data protection law which go beyond the restrictions necessary in a democratic society as provided for in Article 13 of Directive [95/46] where those requirements are likely to have a substantial adverse effect on the guarantees provided by the applicable data protection law and the standard contractual clauses;","paragraph_id":"para_327"},{"text":"(b)","paragraph_id":"para_328"},{"text":"a competent authority has established that the data importer or a sub-processor has not respected the standard contractual clauses in the Annex; or","paragraph_id":"para_329"},{"text":"(c)","paragraph_id":"para_330"},{"text":"there is a substantial likelihood that the standard contractual clauses in the Annex are not being or will not be complied with and the continuing transfer would create an imminent risk of grave harm to the data subjects.","paragraph_id":"para_331"},{"text":"2.   The prohibition or suspension pursuant to paragraph 1 shall be lifted as soon as the reasons for the suspension or prohibition no longer exist.","paragraph_id":"para_332"},{"text":"3.   When Member States adopt measures pursuant to paragraphs 1 and 2, they shall, without delay, inform the Commission which will forward the information to the other Member States.’","paragraph_id":"para_333"},{"text":"31","paragraph_id":"para_334"},{"text":"Recital 5 of Implementing Decision 2016/2297, adopted after the judgment of 6 October 2015, Schrems ( C‑362/14 , EU:C:2015:650 ) was handed down, reads as follows:","paragraph_id":"para_335"},{"text":"‘Mutatis mutandis , a Commission decision adopted pursuant to Article 26(4) of Directive [95/46] is binding on all organs of the Member States to which it is addressed, including their independent supervisory authorities, in so far as it has the effect of recognising that transfers taking place on t …","paragraph_id":"para_336"},{"text":"32","paragraph_id":"para_337"},{"text":"According to its current wording, resulting from Implementing Decision 2016/2297, Article 4 of the SCC Decision states:","paragraph_id":"para_338"},{"text":"‘Whenever the competent authorities in Member States exercise their powers pursuant to Article 28(3) of Directive [95/46] leading to the suspension or definitive ban of data flows to third countries in order to protect individuals with regard to the processing of their personal data, the Member State concerned shall, without delay, inform the Commission which will forward the information to the other Member States.’","paragraph_id":"para_339"},{"text":"33","paragraph_id":"para_340"},{"text":"The annex to the SCC Decision, under the heading ‘Standard Contractual Clauses (Processors)’, is comprised of 12 standard clauses. Clause 3 thereof, itself under the heading ‘Third-party beneficiary clause’, provides:","paragraph_id":"para_341"},{"text":"‘1. The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.","paragraph_id":"para_342"},{"text":"2. The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal o …","paragraph_id":"para_343"},{"text":"…’","paragraph_id":"para_344"},{"text":"34","paragraph_id":"para_345"},{"text":"According to Clause 4 in that annex, under the heading ‘Obligations of the data exporter’:","paragraph_id":"para_346"},{"text":"‘The data exporter agrees and warrants:","paragraph_id":"para_347"},{"text":"(a)","paragraph_id":"para_348"},{"text":"that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;","paragraph_id":"para_349"},{"text":"(b)","paragraph_id":"para_350"},{"text":"that it has instructed and throughout the duration of the personal data-processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;","paragraph_id":"para_351"},{"text":"…","paragraph_id":"para_352"},{"text":"(f)","paragraph_id":"para_353"},{"text":"that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive [95/46];","paragraph_id":"para_354"},{"text":"(g)","paragraph_id":"para_355"},{"text":"to forward any notification received from the data importer or any sub-processor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;","paragraph_id":"para_356"},{"text":"…’","paragraph_id":"para_357"},{"text":"35","paragraph_id":"para_358"},{"text":"Clause 5 in that annex, under the heading ‘Obligations of the data importer …’, provides:","paragraph_id":"para_359"},{"text":"‘The data importer agrees and warrants:","paragraph_id":"para_360"},{"text":"(a)","paragraph_id":"para_361"},{"text":"to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;","paragraph_id":"para_362"},{"text":"(b)","paragraph_id":"para_363"},{"text":"that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the …","paragraph_id":"para_364"},{"text":"…","paragraph_id":"para_365"},{"text":"(d)","paragraph_id":"para_366"},{"text":"that it will promptly notify the data exporter about:","paragraph_id":"para_367"},{"text":"(i)","paragraph_id":"para_368"},{"text":"any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;","paragraph_id":"para_369"},{"text":"(ii)","paragraph_id":"para_370"},{"text":"any accidental or unauthorised access; and","paragraph_id":"para_371"},{"text":"(iii)","paragraph_id":"para_372"},{"text":"any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;","paragraph_id":"para_373"},{"text":"…’","paragraph_id":"para_374"},{"text":"36","paragraph_id":"para_375"},{"text":"The footnote to the heading of Clause 5 states:","paragraph_id":"para_376"},{"text":"‘Mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive [95/46], that is, if they constitute a necessary measure to safeguard nationa …","paragraph_id":"para_377"},{"text":"37","paragraph_id":"para_378"},{"text":"Clause 6 in the annex to the SCC Decision, under the heading ‘Liability’, provides:","paragraph_id":"para_379"},{"text":"‘1. The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or sub-processor is entitled to receive compensation from the data exporter for the damage suffered.","paragraph_id":"para_380"},{"text":"2. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his sub-processor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually …","paragraph_id":"para_381"},{"text":"…’","paragraph_id":"para_382"},{"text":"38","paragraph_id":"para_383"},{"text":"Clause 8 in that annex, under the heading ‘Cooperation with supervisory authorities’, stipulates, in paragraph 2 thereof:","paragraph_id":"para_384"},{"text":"‘The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any sub-processor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.’","paragraph_id":"para_385"},{"text":"39","paragraph_id":"para_386"},{"text":"Clause 9 in that annex, under the heading ‘Governing law’, specifies that the clauses are to be governed by the law of the Member State in which the data exporter is established.","paragraph_id":"para_387"},{"text":"40","paragraph_id":"para_388"},{"text":"According to Clause 11 in that annex, under the heading ‘Sub-processing’:","paragraph_id":"para_389"},{"text":"‘1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporte …","paragraph_id":"para_390"},{"text":"2. The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data expo …","paragraph_id":"para_391"},{"text":"…’","paragraph_id":"para_392"},{"text":"41","paragraph_id":"para_393"},{"text":"Clause 12 in the annex to the SCC Decision, under the heading ‘Obligation after the termination of personal data-processing services’, states, in paragraph 1 thereof:","paragraph_id":"para_394"},{"text":"‘The parties agree that on the termination of the provision of data-processing services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and …","paragraph_id":"para_395"},{"text":"The Privacy Shield Decision","paragraph_id":"para_396"},{"text":"42","paragraph_id":"para_397"},{"text":"In the judgment of 6 October 2015, Schrems ( C‑362/14 , EU:C:2015:650 ), the Court declared Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles a …","paragraph_id":"para_398"},{"text":"43","paragraph_id":"para_399"},{"text":"Following the delivery of that judgment, the Commission adopted the Privacy Shield Decision, after having, for the purposes of adopting that decision, assessed the US legislation, as stated in recital 65 of the decision:","paragraph_id":"para_400"},{"text":"‘The Commission has assessed the limitations and safeguards available in U.S. law as regards access and use of personal data transferred under the EU-U.S. Privacy Shield by U.S. public authorities for national security, law enforcement and other public interest purposes. In addition, the U.S. govern …","paragraph_id":"para_401"},{"text":"44","paragraph_id":"para_402"},{"text":"The Commission’s assessment of those limitations and guarantees is summarised in recitals 67 to 135 of the Privacy Shield Decision, while the Commission’s conclusions on the adequate level of protection in the context of the EU-US Privacy Shield are set out in recitals 136 to 141 thereof.","paragraph_id":"para_403"},{"text":"45","paragraph_id":"para_404"},{"text":"In particular, Recitals 68, 69, 76, 77, 109, 112 to 116, 120, 136 and 140 of the Privacy Shield Decision state:","paragraph_id":"para_405"},{"text":"‘(68)","paragraph_id":"para_406"},{"text":"Under the U.S. Constitution, ensuring national security falls within the President’s authority as Commander in Chief, as Chief Executive and, as regards foreign intelligence, to conduct U.S. foreign affairs … While Congress has the power to impose limitations, and has done so in various respects, wi …","paragraph_id":"para_407"},{"text":"(69)","paragraph_id":"para_408"},{"text":"Presidential Policy Directive 28 (“PPD‑28”), issued on 17 January 2014, imposes a number of limitations for “signals intelligence” operations … This presidential directive has binding force for U.S. intelligence authorities … and remains effective upon change in the U.S. Administration … PPD‑28 is of particular importance for non-US persons, including EU data subjects. …","paragraph_id":"para_409"},{"text":"…","paragraph_id":"para_410"},{"text":"(76)","paragraph_id":"para_411"},{"text":"Although not phrased in … legal terms, [the] principles [of PPD‑28] capture the essence of the principles of necessity and proportionality. …","paragraph_id":"para_412"},{"text":"(77)","paragraph_id":"para_413"},{"text":"As a directive issued by the President as the Chief Executive, these requirements bind the entire Intelligence Community and have been further implemented through agency rules and procedures that transpose the general principles into specific directions for day-to-day operations. …","paragraph_id":"para_414"},{"text":"…","paragraph_id":"para_415"},{"text":"(109)","paragraph_id":"para_416"},{"text":"Conversely, under Section 702 [of the Foreign Intelligence Surveillance Act (FISA)], the [United States Foreign Intelligence Surveillance Court (FISC)] does not authorise individual surveillance measures; rather, it authorises surveillance programs (like PRISM, UPSTREAM) on the basis of annual certi …","paragraph_id":"para_417"},{"text":"…","paragraph_id":"para_418"},{"text":"(112)","paragraph_id":"para_419"},{"text":"First, the [FISA] provides a number of remedies, available also to non-U.S. persons, to challenge unlawful electronic surveillance … This includes the possibility for individuals to bring a civil cause of action for money damages against the United States when information about them has been unlawfu …","paragraph_id":"para_420"},{"text":"(113)","paragraph_id":"para_421"},{"text":"Second, the U.S. government referred the Commission to a number of additional avenues that EU data subjects could use to seek legal recourse against government officials for unlawful government access to, or use of, personal data, including for purported national security purposes …","paragraph_id":"para_422"},{"text":"(114)","paragraph_id":"para_423"},{"text":"Finally, the U.S. government has pointed to the [Freedom of Information Act (FOIA)] as a means for non-U.S. persons to seek access to existing federal agency records, including where these contain the individual’s personal data … Given its focus, the FOIA does not provide an avenue for individual re …","paragraph_id":"para_424"},{"text":"(115)","paragraph_id":"para_425"},{"text":"While individuals, including EU data subjects, therefore have a number of avenues of redress when they have been the subject of unlawful (electronic) surveillance for national security purposes, it is equally clear that at least some legal bases that U.S. intelligence authorities may use (e.g. E.O. …","paragraph_id":"para_426"},{"text":"(116)","paragraph_id":"para_427"},{"text":"In order to provide for an additional redress avenue accessible for all EU data subjects, the U.S. government has decided to create a new Ombudsperson Mechanism as set out in the letter from the U.S. Secretary of State to the Commission which is contained in Annex III to this decision. This mechanis …","paragraph_id":"para_428"},{"text":"…","paragraph_id":"para_429"},{"text":"(120)","paragraph_id":"para_430"},{"text":"… the U.S. government commits to ensure that, in carrying out its functions, the Privacy Shield Ombudsperson will be able to rely on the cooperation from other oversight and compliance review mechanisms existing in U.S. law. … Where any non-compliance has been found by one of these oversight bodies, …","paragraph_id":"para_431"},{"text":"…","paragraph_id":"para_432"},{"text":"(136)","paragraph_id":"para_433"},{"text":"In the light of [those] findings, the Commission considers that the United States ensures an adequate level of protection for personal data transferred from the Union to self-certified organisations in the United States under the EU-U.S. Privacy Shield.","paragraph_id":"para_434"},{"text":"…","paragraph_id":"para_435"},{"text":"(140)","paragraph_id":"para_436"},{"text":"Finally, on the basis of the available information about the U.S. legal order, including the representations and commitments from the U.S. government, the Commission considers that any interference by U.S. public authorities with the fundamental rights of the persons whose data are transferred from …","paragraph_id":"para_437"},{"text":"46","paragraph_id":"para_438"},{"text":"Under Article 1 of the Privacy Shield Decision:","paragraph_id":"para_439"},{"text":"‘1.   For the purposes of Article 25(2) of [Directive 95/46], the United States ensures an adequate level of protection for personal data transferred from the Union to organisations in the United States under the EU-U.S. Privacy Shield.","paragraph_id":"para_440"},{"text":"2.   The EU-U.S. Privacy Shield is constituted by the Principles issued by the U.S. Department of Commerce on 7 July 2016 as set out in Annex II and the official representations and commitments contained in the documents listed in Annexes I [and] III to VII.","paragraph_id":"para_441"},{"text":"3.   For the purpose of paragraph 1, personal data are transferred under the EU-U.S. Privacy Shield where they are transferred from the Union to organisations in the United States that are included in the “Privacy Shield List”, maintained and made publicly available by the U.S. Department of Commerce, in accordance with Sections I and III of the Principles set out in Annex II.’","paragraph_id":"para_442"},{"text":"47","paragraph_id":"para_443"},{"text":"Under the heading ‘EU-U.S. Privacy Shield Framework Principles issued by the U.S. Department of Commerce’, Annex II to the Privacy Shield Decision, provides, in paragraph I.5 thereof, that adherence to those principles may be limited, inter alia, ‘to the extent necessary to meet national security, public interest, or law enforcement requirements’.","paragraph_id":"para_444"},{"text":"48","paragraph_id":"para_445"},{"text":"Annex III to that decision contains a letter from Mr John Kerry, then Secretary of State (United States), to the Commissioner for Justice, Consumers and Gender Equality from 7 July 2016, to which a memorandum, Annex A, was attached, entitled ‘EU-U.S. Privacy Shield Ombudsperson mechanism regarding signals intelligence’, the latter of which contains the following passage:","paragraph_id":"para_446"},{"text":"‘In recognition of the importance of the EU-U.S. Privacy Shield Framework, this Memorandum sets forth the process for implementing a new mechanism, consistent with [PPD‑28], regarding signals intelligence …","paragraph_id":"para_447"},{"text":"… President Obama announced the issuance of a new presidential directive — PPD‑28 — to “clearly prescribe what we do, and do not do, when it comes to our overseas surveillance.”","paragraph_id":"para_448"},{"text":"Section 4(d) of PPD‑28 directs the Secretary of State to designate a “Senior Coordinator for International Information Technology Diplomacy” (Senior Coordinator) “to […] serve as a point of contact for foreign governments who wish to raise concerns regarding signals intelligence activities conducted by the United States.” …","paragraph_id":"para_449"},{"text":"…","paragraph_id":"para_450"},{"text":"1.","paragraph_id":"para_451"},{"text":"… The Senior Coordinator will serve as the Privacy Shield Ombudsperson and … will work closely with appropriate officials from other departments and agencies who are responsible for processing requests in accordance with applicable United States law and policy. The Ombudsperson is independent from t …","paragraph_id":"para_452"},{"text":"…’","paragraph_id":"para_453"},{"text":"49","paragraph_id":"para_454"},{"text":"Annex VI to the Privacy Shield Decision contains a letter from the Office of the Director of National Intelligence to the United States Department of Commerce and to the International Trade Administration from 21 June 2016, in which it is stated that PPD‑28 allows for ‘“bulk” collection … of a relat …","paragraph_id":"para_455"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_456"},{"text":"50","paragraph_id":"para_457"},{"text":"Mr Schrems, an Austrian national residing in Austria, has been a user of the Facebook social network (‘Facebook’) since 2008.","paragraph_id":"para_458"},{"text":"51","paragraph_id":"para_459"},{"text":"Any person residing in the European Union who wishes to use Facebook is required to conclude, at the time of his or her registration, a contract with Facebook Ireland, a subsidiary of Facebook Inc. which is itself established in the United States. Some or all of the personal data of Facebook Ireland’s users who reside in the European Union is transferred to servers belonging to Facebook Inc. that are located in the United States, where it undergoes processing.","paragraph_id":"para_460"},{"text":"52","paragraph_id":"para_461"},{"text":"On 25 June 2013, Mr Schrems filed a complaint with the Commissioner whereby he requested, in essence, that Facebook Ireland be prohibited from transferring his personal data to the United States, on the ground that the law and practice in force in that country did not ensure adequate protection of t …","paragraph_id":"para_462"},{"text":"53","paragraph_id":"para_463"},{"text":"The High Court (Ireland), before which Mr Schrems had brought judicial review proceedings against the rejection of his complaint, made a request to the Court for a preliminary ruling on the interpretation and validity of Decision 2000/520. In a judgment of 6 October 2015, Schrems ( C‑362/14 , EU:C:2015:650 ), the Court declared that decision invalid.","paragraph_id":"para_464"},{"text":"54","paragraph_id":"para_465"},{"text":"Following that judgment, the referring court annulled the rejection of Mr Schrems’s complaint and referred that decision back to the Commissioner. In the course of the Commissioner’s investigation, Facebook Ireland explained that a large part of personal data was transferred to Facebook Inc. pursuant to the standard data protection clauses set out in the annex to the SCC Decision. On that basis, the Commissioner asked Mr Schrems to reformulate his complaint.","paragraph_id":"para_466"},{"text":"55","paragraph_id":"para_467"},{"text":"In his reformulated complaint lodged on 1 December 2015, Mr Schrems claimed, inter alia, that United States law requires Facebook Inc. to make the personal data transferred to it available to certain United States authorities, such as the National Security Agency (NSA) and the Federal Bureau of Inve …","paragraph_id":"para_468"},{"text":"56","paragraph_id":"para_469"},{"text":"On 24 May 2016, the Commissioner published a ‘draft decision’ summarising the provisional findings of her investigation. In that draft decision, she took the provisional view that the personal data of EU citizens transferred to the United States were likely to be consulted and processed by the US au …","paragraph_id":"para_470"},{"text":"57","paragraph_id":"para_471"},{"text":"Taking the view that, in those circumstances, Mr Schrems’s reformulated complaint raised the issue of the validity of the SCC Decision, on 31 May 2016, the Commissioner brought an action before the High Court, relying on the case-law arising from the judgment of 6 October 2015, Schrems ( C‑362/14 , …","paragraph_id":"para_472"},{"text":"58","paragraph_id":"para_473"},{"text":"In an annex to the order for reference, the High Court provided a copy of a judgment handed down on 3 October 2017, in which it had set out the results of an examination of the evidence produced before it in the national proceedings, in which the US Government had participated.","paragraph_id":"para_474"},{"text":"59","paragraph_id":"para_475"},{"text":"In that judgment, to which the request for a preliminary ruling refers on several occasions, the referring court stated that, as a matter of principle, it is not only entitled, but is obliged, to consider all of the facts and arguments presented to it and to decide on the basis of those facts and ar …","paragraph_id":"para_476"},{"text":"60","paragraph_id":"para_477"},{"text":"According to the findings in that judgment, the US authorities’ intelligence activities concerning the personal data transferred to the United States are based, inter alia, on Section 702 of the FISA and on E.O. 12333.","paragraph_id":"para_478"},{"text":"61","paragraph_id":"para_479"},{"text":"In its judgment, the referring court specifies that Section 702 of the FISA permits the Attorney General and the Director of National Intelligence to authorise jointly, following FISC approval, the surveillance of individuals who are not United States citizens located outside the United States in or …","paragraph_id":"para_480"},{"text":"62","paragraph_id":"para_481"},{"text":"As regards the UPSTREAM programme, that court found that, in the context of that programme, telecommunications undertakings operating the ‘backbone’ of the Internet — that is to say, the network of cables, switches and routers — are required to allow the NSA to copy and filter Internet traffic flows …","paragraph_id":"para_482"},{"text":"63","paragraph_id":"para_483"},{"text":"The referring court found that E.O. 12333 allows the NSA to access data ‘in transit’ to the United States, by accessing underwater cables on the floor of the Atlantic, and to collect and retain such data before arriving in the United States and being subject there to the FISA. It adds that activities conducted pursuant to E.O. 12333 are not governed by statute.","paragraph_id":"para_484"},{"text":"64","paragraph_id":"para_485"},{"text":"As regards the limits on intelligence activities, the referring court emphasises the fact that non-US persons are covered only by PPD‑28, which merely states that intelligence activities should be ‘as tailored as feasible’. On the basis of those findings, the referring court considers that the United States carries out mass processing of personal data without ensuring a level of protection essentially equivalent to that guaranteed by Articles 7 and 8 of the Charter.","paragraph_id":"para_486"},{"text":"65","paragraph_id":"para_487"},{"text":"As regards judicial protection, the referring court states that EU citizens do not have the same remedies as US citizens in respect of the processing of personal data by the US authorities, since the Fourth Amendment to the Constitution of the United States, which constitutes, in United States law, …","paragraph_id":"para_488"},{"text":"66","paragraph_id":"para_489"},{"text":"In its request for reference preliminary ruling, the referring court also states that the parties to the main proceedings disagree, inter alia, on the applicability of EU law to transfers to a third country of personal data which are likely to be processed by the authorities of that country, inter a …","paragraph_id":"para_490"},{"text":"67","paragraph_id":"para_491"},{"text":"As regards those standard data protection clauses, that court asks whether the SCC Decision may be considered to be valid, despite the fact that, according to that court, those clauses are not binding on the State authorities of the third country concerned and, therefore, are not capable of remedyin …","paragraph_id":"para_492"},{"text":"68","paragraph_id":"para_493"},{"text":"In those circumstances, the High Court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_494"},{"text":"(1)","paragraph_id":"para_495"},{"text":"In circumstances in which personal data is transferred by a private company from a European Union (EU) Member State to a private company in a third country for a commercial purpose pursuant to [the SCC Decision] and may be further processed in the third country by its authorities for purposes of nat …","paragraph_id":"para_496"},{"text":"(2)","paragraph_id":"para_497"},{"text":"(a)","paragraph_id":"para_498"},{"text":"In determining whether there is a violation of the rights of an individual through the transfer of data from the [European Union] to a third country under the [SCC Decision] where it may be further processed for national security purposes, is the relevant comparator for the purposes of [Directive 95/46]:","paragraph_id":"para_499"},{"text":"(i)","paragraph_id":"para_500"},{"text":"the Charter, the EU Treaty, the FEU Treaty, [Directive 95/46], the [European Convention for the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950] (or any other provision of EU law); or","paragraph_id":"para_501"},{"text":"(ii)","paragraph_id":"para_502"},{"text":"the national laws of one or more Member States?","paragraph_id":"para_503"},{"text":"(b)","paragraph_id":"para_504"},{"text":"If the relevant comparator is (ii), are the practices in the context of national security in one or more Member States also to be included in the comparator?","paragraph_id":"para_505"},{"text":"(3)","paragraph_id":"para_506"},{"text":"When assessing whether a third country ensures the level of protection required by EU law to personal data transferred to that country for the purposes of Article 26 of [Directive 95/46], ought the level of protection in the third country be assessed by reference to:","paragraph_id":"para_507"},{"text":"(a)","paragraph_id":"para_508"},{"text":"the applicable rules in the third country resulting from its domestic law or international commitments, and the practice designed to ensure compliance with those rules, to include the professional rules and security measures which are complied with in the third country;","paragraph_id":"para_509"},{"text":"or","paragraph_id":"para_510"},{"text":"(b)","paragraph_id":"para_511"},{"text":"the rules referred to in (a) together with such administrative, regulatory and compliance practices and policy safeguards, procedures, protocols, oversight mechanisms and non-judicial remedies as are in place in the third country?","paragraph_id":"para_512"},{"text":"(4)","paragraph_id":"para_513"},{"text":"Given the facts found by the High Court in relation to US law, if personal data is transferred from the European Union to the United States under [the SCC Decision] does this violate the rights of individuals under Articles 7 and/or 8 of the Charter?","paragraph_id":"para_514"},{"text":"(5)","paragraph_id":"para_515"},{"text":"Given the facts found by the High Court in relation to US law, if personal data is transferred from the European Union to the United States under [the SCC Decision]:","paragraph_id":"para_516"},{"text":"(a)","paragraph_id":"para_517"},{"text":"does the level of protection afforded by the United States respect the essence of an individual’s right to a judicial remedy for breach of his or her data privacy rights guaranteed by Article 47 of the Charter?","paragraph_id":"para_518"},{"text":"If the answer to Question 5(a) is in the affirmative:","paragraph_id":"para_519"},{"text":"(b)","paragraph_id":"para_520"},{"text":"are the limitations imposed by US law on an individual’s right to a judicial remedy in the context of US national security proportionate within the meaning of Article 52 of the Charter and do not exceed what is necessary in a democratic society for national security purposes?","paragraph_id":"para_521"},{"text":"(6)","paragraph_id":"para_522"},{"text":"(a)","paragraph_id":"para_523"},{"text":"What is the level of protection required to be afforded to personal data transferred to a third country pursuant to standard contractual clauses adopted in accordance with a decision of the Commission under Article 26(4) [of Directive 95/46] in light of the provisions of [Directive 95/46] and in particular Articles 25 and 26 read in the light of the Charter?","paragraph_id":"para_524"},{"text":"(b)","paragraph_id":"para_525"},{"text":"What are the matters to be taken into account in assessing whether the level of protection afforded to data transferred to a third country under [the SCC Decision] satisfies the requirements of [Directive 95/46] and the Charter?","paragraph_id":"para_526"},{"text":"(7)","paragraph_id":"para_527"},{"text":"Does the fact that the standard contractual clauses apply as between the data exporter and the data importer and do not bind the national authorities of a third country who may require the data importer to make available to its security services for further processing the personal data transferred pursuant to the clauses provided for in [the SCC Decision] preclude the clauses from adducing adequate safeguards as envisaged by Article 26(2) of [Directive 95/46]?","paragraph_id":"para_528"},{"text":"(8)","paragraph_id":"para_529"},{"text":"If a third country data importer is subject to surveillance laws that in the view of a data protection authority conflict with the [standard contractual clauses] or Article 25 and 26 of [Directive 95/46] and/or the Charter, is a data protection authority required to use its enforcement powers under …","paragraph_id":"para_530"},{"text":"(9)","paragraph_id":"para_531"},{"text":"(a)","paragraph_id":"para_532"},{"text":"For the purposes of Article 25(6) of [Directive 95/46], does [the Privacy Shield Decision] constitute a finding of general application binding on data protection authorities and the courts of the Member States to the effect that the United States ensures an adequate level of protection within the meaning of Article 25(2) of [Directive 95/46] by reason of its domestic law or of the international commitments it has entered into?","paragraph_id":"para_533"},{"text":"(b)","paragraph_id":"para_534"},{"text":"If it does not, what relevance, if any, does the Privacy Shield Decision have in the assessment conducted into the adequacy of the safeguards provided to data transferred to the United States which is transferred pursuant to the [SCC Decision]?","paragraph_id":"para_535"},{"text":"(10)","paragraph_id":"para_536"},{"text":"Given the findings of the High Court in relation to US law, does the provision of the Privacy Shield ombudsperson under Annex A to Annex III to the Privacy Shield Decision when taken in conjunction with the existing regime in the United States ensure that the US provides a remedy to data subjects whose personal data is transferred to the United States under the [SCC Decision] that is compatible with Article 47 of the Charter]?","paragraph_id":"para_537"},{"text":"(11)","paragraph_id":"para_538"},{"text":"Does the [SCC Decision] violate Articles 7, 8 and/or 47 of the Charter?’","paragraph_id":"para_539"},{"text":"Admissibility of the request for a preliminary ruling","paragraph_id":"para_540"},{"text":"69","paragraph_id":"para_541"},{"text":"Facebook Ireland and the German and United Kingdom Governments claim that the request for a preliminary ruling is inadmissible.","paragraph_id":"para_542"},{"text":"70","paragraph_id":"para_543"},{"text":"With regard to the objection raised by Facebook Ireland, that company observes that the provisions of Directive 95/46, on which the questions referred for a preliminary ruling are based, were repealed by the GDPR.","paragraph_id":"para_544"},{"text":"71","paragraph_id":"para_545"},{"text":"In that regard, although Directive 95/46 was, under Article 94(1) of the GDPR, repealed with effect from 25 May 2018, that directive was still in force when, on 4 May 2018, the present request for a preliminary ruling, received at the Court on 9 May 2018, was made. In addition, the first indent of A …","paragraph_id":"para_546"},{"text":"72","paragraph_id":"para_547"},{"text":"For its part, the German Government bases its objection of inadmissibility on the fact, first, that the Commissioner merely expressed doubts, and not a definitive opinion, as to the validity of the SCC Decision and, second, that the referring court failed to ascertain whether Mr Schrems had unambigu …","paragraph_id":"para_548"},{"text":"73","paragraph_id":"para_549"},{"text":"It follows from settled case-law of the Court that it is solely for the national court before which the dispute has been brought, and which must assume responsibility for the subsequent judicial decision, to determine, in the light of the particular circumstances of the case, both the need for a pre …","paragraph_id":"para_550"},{"text":"74","paragraph_id":"para_551"},{"text":"In the present case, the request for a preliminary ruling contains sufficient factual and legal material to understand the significance of the questions referred. Furthermore, and most importantly, nothing in the file before the Court leads to the conclusion that the interpretation of EU law that is …","paragraph_id":"para_552"},{"text":"75","paragraph_id":"para_553"},{"text":"Moreover, it is irrelevant to the admissibility of the present request for a preliminary ruling that the Commissioner did not express a definitive opinion on the validity of that decision in so far as the referring court considers that an answer to the questions referred for a preliminary ruling concerning the interpretation and validity of rules of EU law is necessary in order to dispose of the case in the main proceedings.","paragraph_id":"para_554"},{"text":"76","paragraph_id":"para_555"},{"text":"It follows that the request for a preliminary ruling is admissible.","paragraph_id":"para_556"},{"text":"Consideration of the questions referred","paragraph_id":"para_557"},{"text":"77","paragraph_id":"para_558"},{"text":"As a preliminary matter, it must be borne in mind that the present request for a preliminary ruling has arisen following a complaint made by Mr Schrems requesting that the Commissioner order the suspension or prohibition, in the future, of the transfer by Facebook Ireland of his personal data to Fac …","paragraph_id":"para_559"},{"text":"78","paragraph_id":"para_560"},{"text":"That absence of a national decision distinguishes the situation at issue in the main proceedings from those which gave rise to the judgments of 24 September 2019, Google (Territorial scope of de-referencing) ( C‑507/17 , EU:C:2019:772 ), and of 1 October 2019, Planet49 ( C‑673/17 , EU:C:2019:801 ), in which decisions adopted prior to the repeal of that directive were at issue.","paragraph_id":"para_561"},{"text":"79","paragraph_id":"para_562"},{"text":"The questions referred for a preliminary ruling must therefore be answered in the light of the provisions of the GDPR rather than those of Directive 95/46.","paragraph_id":"para_563"},{"text":"The first question","paragraph_id":"para_564"},{"text":"80","paragraph_id":"para_565"},{"text":"By its first question, the referring court wishes to know, in essence, whether Article 2(1) and Article 2(2)(a), (b) and (d) of the GDPR, read in conjunction with Article 4(2) TEU, must be interpreted as meaning that that regulation applies to the transfer of personal data by an economic operator es …","paragraph_id":"para_566"},{"text":"81","paragraph_id":"para_567"},{"text":"In that regard, it should be made clear at the outset that the rule in Article 4(2) TEU, according to which, within the European Union, national security remains the sole responsibility of each Member State, concerns Member States of the European Union only. That rule is therefore irrelevant, in the present case, for the purposes of interpreting Article 2(1) and Article 2(2)(a), (b) and (d) of the GDPR.","paragraph_id":"para_568"},{"text":"82","paragraph_id":"para_569"},{"text":"Under Article 2(1) of the GDPR, that regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. Article 4(2) of that …","paragraph_id":"para_570"},{"text":"83","paragraph_id":"para_571"},{"text":"It follows that the operation of having personal data transferred from a Member State to a third country constitutes, in itself, processing of personal data within the meaning of Article 4(2) of the GDPR, carried out in a Member State, and falls within the scope of that regulation under Article 2(1) …","paragraph_id":"para_572"},{"text":"84","paragraph_id":"para_573"},{"text":"As to whether such an operation may be regarded as being excluded from the scope of the GDPR under Article 2(2) thereof, it should be noted that that provision lays down exceptions to the scope of that regulation, as defined in Article 2(1) thereof, which must be interpreted strictly (see, by analogy, as regards Article 3(2) of Directive 95/46, judgment of 10 July 2018, Jehovan todistajat, C‑25/17 , EU:C:2018:551 , paragraph  37 and the case-law cited).","paragraph_id":"para_574"},{"text":"85","paragraph_id":"para_575"},{"text":"In the present case, since the transfer of personal data at issue in the main proceedings is from Facebook Ireland to Facebook Inc., namely between two legal persons, that transfer does not fall within Article 2(2)(c) of the GDPR, which refers to the processing of data by a natural person in the cou …","paragraph_id":"para_576"},{"text":"86","paragraph_id":"para_577"},{"text":"The possibility that the personal data transferred between two economic operators for commercial purposes might undergo, at the time of the transfer or thereafter, processing for the purposes of public security, defence and State security by the authorities of that third country cannot remove that transfer from the scope of the GDPR.","paragraph_id":"para_578"},{"text":"87","paragraph_id":"para_579"},{"text":"Indeed, by expressly requiring the Commission, when assessing the adequacy of the level of protection afforded by a third country, to take account, inter alia, of ‘relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and t …","paragraph_id":"para_580"},{"text":"88","paragraph_id":"para_581"},{"text":"It follows that such a transfer cannot fall outside the scope of the GDPR on the ground that the data at issue is liable to be processed, at the time of that transfer or thereafter, by the authorities of the third country concerned, for the purposes of public security, defence and State security.","paragraph_id":"para_582"},{"text":"89","paragraph_id":"para_583"},{"text":"Therefore, the answer to the first question is that Article 2(1) and (2) of the GDPR must be interpreted as meaning that that regulation applies to the transfer of personal data for commercial purposes by an economic operator established in a Member State to another economic operator established in …","paragraph_id":"para_584"},{"text":"The second, third and sixth questions","paragraph_id":"para_585"},{"text":"90","paragraph_id":"para_586"},{"text":"By its second, third and sixth questions, the referring court seeks clarification from the Court, in essence, on the level of protection required by Article 46(1) and Article 46(2)(c) of the GDPR in respect of a transfer of personal data to a third country based on standard data protection clauses. …","paragraph_id":"para_587"},{"text":"91","paragraph_id":"para_588"},{"text":"As regards the level of protection required, it follows from a combined reading of those provisions that, in the absence of an adequacy decision under Article 45(3) of that regulation, a controller or processor may transfer personal data to a third country only if the controller or processor has pro …","paragraph_id":"para_589"},{"text":"92","paragraph_id":"para_590"},{"text":"Although Article 46 of the GDPR does not specify the nature of the requirements which flow from that reference to ‘appropriate safeguards’, ‘enforceable rights’ and ‘effective legal remedies’, it should be noted that that article appears in Chapter V of that regulation and, accordingly, must be read …","paragraph_id":"para_591"},{"text":"93","paragraph_id":"para_592"},{"text":"As the Advocate General stated in point 117 of his Opinion, the provisions of Chapter V of the GDPR are intended to ensure the continuity of that high level of protection where personal data is transferred to a third country, in accordance with the objective set out in recital 6 thereof.","paragraph_id":"para_593"},{"text":"94","paragraph_id":"para_594"},{"text":"The first sentence of Article 45(1) of the GDPR provides that a transfer of personal data to a third country may be authorised by a Commission decision to the effect that that third country, a territory or one or more specified sectors within that third country, ensures an adequate level of protecti …","paragraph_id":"para_595"},{"text":"95","paragraph_id":"para_596"},{"text":"In that context, recital 107 of the GDPR states that, where ‘a third country, a territory or a specified sector within a third country … no longer ensures an adequate level of data protection. … the transfer of personal data to that third country … should be prohibited, unless the requirements [of t …","paragraph_id":"para_597"},{"text":"96","paragraph_id":"para_598"},{"text":"It follows, as the Advocate General stated in point 115 of his Opinion, that such appropriate guarantees must be capable of ensuring that data subjects whose personal data are transferred to a third country pursuant to standard data protection clauses are afforded, as in the context of a transfer based on an adequacy decision, a level of protection essentially equivalent to that which is guaranteed within the European Union.","paragraph_id":"para_599"},{"text":"97","paragraph_id":"para_600"},{"text":"The referring court also asks whether the level of protection essentially equivalent to that guaranteed within the European Union must be determined in the light of EU law, in particular the rights guaranteed by the Charter and/or the fundamental rights enshrined in the European Convention for the Protection of Human Rights and Fundamental Freedoms (‘the ECHR’), or in the light of the national law of the Member States.","paragraph_id":"para_601"},{"text":"98","paragraph_id":"para_602"},{"text":"In that regard, it should be noted that, although, as Article 6(3) TEU confirms, the fundamental rights enshrined in the ECHR constitute general principles of EU law and although Article 52(3) of the Charter provides that the rights contained in the Charter which correspond to rights guaranteed by t …","paragraph_id":"para_603"},{"text":"99","paragraph_id":"para_604"},{"text":"In those circumstances, the Court has held that the interpretation of EU law and examination of the legality of EU legislation must be undertaken in the light of the fundamental rights guaranteed by the Charter (see, by analogy, judgment of 20 March 2018, Menci, C‑524/15 , EU:C:2018:197 , paragraph  24 ).","paragraph_id":"para_605"},{"text":"100","paragraph_id":"para_606"},{"text":"Furthermore, the Court has consistently held that the validity of provisions of EU law and, in the absence of an express reference to the national law of the Member States, their interpretation, cannot be construed in the light of national law, even national law of constitutional status, in particul …","paragraph_id":"para_607"},{"text":"101","paragraph_id":"para_608"},{"text":"It follows that, since, first, a transfer of personal data, such as that at issue in the main proceedings, for commercial purposes by an economic operator established in one Member State to another economic operator established in a third country, falls, as is apparent from the answer to the first q …","paragraph_id":"para_609"},{"text":"102","paragraph_id":"para_610"},{"text":"The referring court also seeks to ascertain what factors should be taken into consideration for the purposes of determining the adequacy of the level of protection where personal data is transferred to a third country pursuant to standard data protection clauses adopted under Article 46(2)(c) of the GDPR.","paragraph_id":"para_611"},{"text":"103","paragraph_id":"para_612"},{"text":"In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.","paragraph_id":"para_613"},{"text":"104","paragraph_id":"para_614"},{"text":"The assessment required for that purpose in the context of such a transfer must, in particular, take into consideration both the contractual clauses agreed between the controller or processor established in the European Union and the recipient of the transfer established in the third country concern …","paragraph_id":"para_615"},{"text":"105","paragraph_id":"para_616"},{"text":"Therefore, the answer to the second, third and sixth questions is that Article 46(1) and Article 46(2)(c) of the GDPR must be interpreted as meaning that the appropriate safeguards, enforceable rights and effective legal remedies required by those provisions must ensure that data subjects whose pers …","paragraph_id":"para_617"},{"text":"The eighth question","paragraph_id":"para_618"},{"text":"106","paragraph_id":"para_619"},{"text":"By its eighth question, the referring court wishes to know, in essence, whether Article 58(2)(f) and (j) of the GDPR must be interpreted as meaning that the competent supervisory authority is required to suspend or prohibit a transfer of personal data to a third country pursuant to standard data pro …","paragraph_id":"para_620"},{"text":"107","paragraph_id":"para_621"},{"text":"In accordance with Article 8(3) of the Charter and Article 51(1) and Article 57(1)(a) of the GDPR, the national supervisory authorities are responsible for monitoring compliance with the EU rules concerning the protection of natural persons with regard to the processing of personal data. Each of tho …","paragraph_id":"para_622"},{"text":"108","paragraph_id":"para_623"},{"text":"It follows from those provisions that the supervisory authorities’ primary responsibility is to monitor the application of the GDPR and to ensure its enforcement. The exercise of that responsibility is of particular importance where personal data is transferred to a third country since, as is clear …","paragraph_id":"para_624"},{"text":"109","paragraph_id":"para_625"},{"text":"In addition, under Article 57(1)(f) of the GDPR, each supervisory authority is required on its territory to handle complaints which, in accordance with Article 77(1) of that regulation, any data subject is entitled to lodge where that data subject considers that the processing of his or her personal …","paragraph_id":"para_626"},{"text":"110","paragraph_id":"para_627"},{"text":"Article 78(1) and (2) of the GDPR recognises the right of each person to an effective judicial remedy, in particular, where the supervisory authority fails to deal with his or her complaint. Recital 141 of that regulation also refers to that ‘right to an effective judicial remedy in accordance with Article 47 of the Charter’ in circumstances where that supervisory authority ‘does not act where such action is necessary to protect the rights of the data subject’.","paragraph_id":"para_628"},{"text":"111","paragraph_id":"para_629"},{"text":"In order to handle complaints lodged, Article 58(1) of the GDPR confers extensive investigative powers on each supervisory authority. If a supervisory authority takes the view, following an investigation, that a data subject whose personal data have been transferred to a third country is not afforde …","paragraph_id":"para_630"},{"text":"112","paragraph_id":"para_631"},{"text":"Although the supervisory authority must determine which action is appropriate and necessary and take into consideration all the circumstances of the transfer of personal data in question in that determination, the supervisory authority is nevertheless required to execute its responsibility for ensuring that the GDPR is fully enforced with all due diligence.","paragraph_id":"para_632"},{"text":"113","paragraph_id":"para_633"},{"text":"In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of t …","paragraph_id":"para_634"},{"text":"114","paragraph_id":"para_635"},{"text":"The interpretation in the previous paragraph is not undermined by the Commissioner’s reasoning that Article 4 of Decision 2010/87, in its version prior to the entry into force of Implementing Decision 2016/2297, read in the light of recital 11 of that decision, confined the power of supervisory auth …","paragraph_id":"para_636"},{"text":"115","paragraph_id":"para_637"},{"text":"In any event, the implementing power which Article 46(2)(c) of the GDPR grants to the Commission for the purposes of adopting standard data protection clauses does not confer upon it competence to restrict the national supervisory authorities’ powers on the basis of Article 58(2) of that regulation …","paragraph_id":"para_638"},{"text":"116","paragraph_id":"para_639"},{"text":"It should, however, be pointed out that the powers of the competent supervisory authority are subject to full compliance with the decision in which the Commission finds, where relevant, under the first sentence of Article 45(1) of the GDPR, that a particular third country ensures an adequate level o …","paragraph_id":"para_640"},{"text":"117","paragraph_id":"para_641"},{"text":"Under the fourth paragraph of Article 288 TFEU, a Commission adequacy decision is, in its entirety, binding on all the Member States to which it is addressed and is therefore binding on all their organs in so far as it finds that the third country in question ensures an adequate level of protection …","paragraph_id":"para_642"},{"text":"118","paragraph_id":"para_643"},{"text":"Thus, until such time as a Commission adequacy decision is declared invalid by the Court, the Member States and their organs, which include their independent supervisory authorities, cannot adopt measures contrary to that decision, such as acts intended to determine with binding effect that the thir …","paragraph_id":"para_644"},{"text":"119","paragraph_id":"para_645"},{"text":"However, a Commission adequacy decision adopted pursuant to Article 45(3) of the GDPR cannot prevent persons whose personal data has been or could be transferred to a third country from lodging a complaint, within the meaning of Article 77(1) of the GDPR, with the competent national supervisory auth …","paragraph_id":"para_646"},{"text":"120","paragraph_id":"para_647"},{"text":"Thus, even if the Commission has adopted a Commission adequacy decision, the competent national supervisory authority, when a complaint is lodged by a person concerning the protection of his or her rights and freedoms in regard to the processing of personal data relating to him or her, must be able …","paragraph_id":"para_648"},{"text":"121","paragraph_id":"para_649"},{"text":"In the light of the foregoing considerations, the answer to the eighth question is that Article 58(2)(f) and (j) of the GDPR must be interpreted as meaning that, unless there is a valid Commission adequacy decision, the competent supervisory authority is required to suspend or prohibit a transfer of …","paragraph_id":"para_650"},{"text":"The7th and 11th questions","paragraph_id":"para_651"},{"text":"122","paragraph_id":"para_652"},{"text":"By its 7th and 11th questions, which it is appropriate to consider together, the referring court seeks clarification from the Court, in essence, on the validity of the SCC Decision in the light of Articles 7, 8 and 47 of the Charter.","paragraph_id":"para_653"},{"text":"123","paragraph_id":"para_654"},{"text":"In particular, as is clear from the wording of the seventh question and the corresponding explanations in the request for a preliminary ruling, the referring court asks whether the SCC Decision is capable of ensuring an adequate level of protection of the personal data transferred to third countries given that the standard data protection clauses provided for in that decision do not bind the supervisory authorities of those third countries.","paragraph_id":"para_655"},{"text":"124","paragraph_id":"para_656"},{"text":"Article 1 of the SCC Decision provides that the standard data protection clauses set out in its annex are considered to offer adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals in accordance with the requirements of Article 26(2) of Directive 95/46. The latter provision was, in essence, reproduced in Article 46(1) and Article 46(2)(c) of the GDPR.","paragraph_id":"para_657"},{"text":"125","paragraph_id":"para_658"},{"text":"However, although those clauses are binding on a controller established in the European Union and the recipient of the transfer of personal data established in a third country where they have concluded a contract incorporating those clauses, it is common ground that those clauses are not capable of binding the authorities of that third country, since they are not party to the contract.","paragraph_id":"para_659"},{"text":"126","paragraph_id":"para_660"},{"text":"Therefore, although there are situations in which, depending on the law and practices in force in the third country concerned, the recipient of such a transfer is in a position to guarantee the necessary protection of the data solely on the basis of standard data protection clauses, there are others …","paragraph_id":"para_661"},{"text":"127","paragraph_id":"para_662"},{"text":"Thus, the question arises whether a Commission decision concerning standard data protection clauses, adopted pursuant to Article 46(2)(c) of the GDPR, is invalid in the absence, in that decision, of guarantees which can be enforced against the public authorities of the third countries to which personal data is or could be transferred pursuant to those clauses.","paragraph_id":"para_663"},{"text":"128","paragraph_id":"para_664"},{"text":"Article 46(1) of the GDPR provides that, in the absence of an adequacy decision, a controller or processor may transfer personal data to a third country only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal …","paragraph_id":"para_665"},{"text":"129","paragraph_id":"para_666"},{"text":"It should be noted in that regard that such a standard clauses decision differs from an adequacy decision adopted pursuant to Article 45(3) of the GDPR, which seeks, following an examination of the legislation of the third country concerned taking into account, inter alia, the relevant legislation o …","paragraph_id":"para_667"},{"text":"130","paragraph_id":"para_668"},{"text":"By contrast, in the case of a Commission decision adopting standard data protection clauses, such as the SCC Decision, in so far as such a decision does not refer to a third country, a territory or one or more specific sectors in a third country, it cannot be inferred from Article 46(1) and Article …","paragraph_id":"para_669"},{"text":"131","paragraph_id":"para_670"},{"text":"In that regard, it must be borne in mind that, according to Article 46(1) of the GDPR, in the absence of a Commission adequacy decision, it is for the controller or processor established in the European Union to provide, inter alia, appropriate safeguards. Recitals 108 and 114 of the GDPR confirm th …","paragraph_id":"para_671"},{"text":"132","paragraph_id":"para_672"},{"text":"Since by their inherently contractual nature standard data protection clauses cannot bind the public authorities of third countries, as is clear from paragraph 125 above, but that Article 44, Article 46(1) and Article 46(2)(c) of the GDPR, interpreted in the light of Articles 7, 8 and 47 of the Char …","paragraph_id":"para_673"},{"text":"133","paragraph_id":"para_674"},{"text":"It follows that the standard data protection clauses adopted by the Commission on the basis of Article 46(2)(c) of the GDPR are solely intended to provide contractual guarantees that apply uniformly in all third countries to controllers and processors established in the European Union and, consequen …","paragraph_id":"para_675"},{"text":"134","paragraph_id":"para_676"},{"text":"In that regard, as the Advocate General stated in point 126 of his Opinion, the contractual mechanism provided for in Article 46(2)(c) of the GDPR is based on the responsibility of the controller or his or her subcontractor established in the European Union and, in the alternative, of the competent …","paragraph_id":"para_677"},{"text":"135","paragraph_id":"para_678"},{"text":"Where the controller or a processor established in the European Union is not able to take adequate additional measures to guarantee such protection, the controller or processor or, failing that, the competent supervisory authority, are required to suspend or end the transfer of personal data to the …","paragraph_id":"para_679"},{"text":"136","paragraph_id":"para_680"},{"text":"Therefore, the mere fact that standard data protection clauses in a Commission decision adopted pursuant to Article 46(2)(c) of the GDPR, such as those in the annex to the SCC Decision, do not bind the authorities of third countries to which personal data may be transferred cannot affect the validity of that decision.","paragraph_id":"para_681"},{"text":"137","paragraph_id":"para_682"},{"text":"That validity depends, however, on whether, in accordance with the requirement of Article 46(1) and Article 46(2)(c) of the GDPR, interpreted in the light of Articles 7, 8 and 47 of the Charter, such a standard clauses decision incorporates effective mechanisms that make it possible, in practice, to …","paragraph_id":"para_683"},{"text":"138","paragraph_id":"para_684"},{"text":"As regards the guarantees contained in the standard data protection clauses in the annex to the SCC Decision, it is clear from Clause 4(a) and (b), Clause 5(a), Clause 9 and Clause 11(1) thereof that a data controller established in the European Union, the recipient of the personal data and any proc …","paragraph_id":"para_685"},{"text":"139","paragraph_id":"para_686"},{"text":"In addition, a recipient of personal data established in a third country undertakes, pursuant to Clause 5(a), to inform the controller established in the European Union promptly of any inability to comply with its obligations under the contract concluded. In particular, according to Clause 5(b), the …","paragraph_id":"para_687"},{"text":"140","paragraph_id":"para_688"},{"text":"Clause 5(a) and (b), in both cases to which it refers, confers on the controller established in the European Union the right to suspend the transfer of data and/or to terminate the contract. In the light of the requirements of Article 46(1) and (2)(c) of the GDPR, read in the light of Articles 7 and …","paragraph_id":"para_689"},{"text":"141","paragraph_id":"para_690"},{"text":"It follows that Clause 4(a) and Clause 5(a) and (b) in that annex oblige the controller established in the European Union and the recipient of personal data to satisfy themselves that the legislation of the third country of destination enables the recipient to comply with the standard data protectio …","paragraph_id":"para_691"},{"text":"142","paragraph_id":"para_692"},{"text":"It follows that a controller established in the European Union and the recipient of personal data are required to verify, prior to any transfer, whether the level of protection required by EU law is respected in the third country concerned. The recipient is, where appropriate, under an obligation, u …","paragraph_id":"para_693"},{"text":"143","paragraph_id":"para_694"},{"text":"If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from …","paragraph_id":"para_695"},{"text":"144","paragraph_id":"para_696"},{"text":"It should be added that, under Clause 4(f) in the annex to the SCC Decision, a controller established in the European Union undertakes, where special categories of data could be transferred to a third country not providing adequate protection, to inform the data subject before, or as soon as possibl …","paragraph_id":"para_697"},{"text":"145","paragraph_id":"para_698"},{"text":"Lastly, under Clause 4(g) in that annex, the controller established in the European Union is required, when the recipient of personal data notifies him or her, pursuant to Clause 5(b), in the event of a change in the relevant legislation which is likely to have a substantial adverse effect on the wa …","paragraph_id":"para_699"},{"text":"146","paragraph_id":"para_700"},{"text":"In that context, Article 4 of the SCC Decision, read in the light of recital 5 of Implementing Decision 2016/2297, supports the view that the SCC Decision does not prevent the competent supervisory authority from suspending or prohibiting, as appropriate, a transfer of personal data to a third count …","paragraph_id":"para_701"},{"text":"147","paragraph_id":"para_702"},{"text":"As regards the fact, underlined by the Commissioner, that transfers of personal data to such a third country may result in the supervisory authorities in the various Member States adopting divergent decisions, it should be added that, as is clear from Article 55(1) and Article 57(1)(a) of the GDPR, …","paragraph_id":"para_703"},{"text":"148","paragraph_id":"para_704"},{"text":"It follows that the SCC Decision provides for effective mechanisms which, in practice, ensure that the transfer to a third country of personal data pursuant to the standard data protection clauses in the annex to that decision is suspended or prohibited where the recipient of the transfer does not comply with those clauses or is unable to comply with them.","paragraph_id":"para_705"},{"text":"149","paragraph_id":"para_706"},{"text":"In the light of all of the foregoing considerations, the answer to the 7th and 11th questions is that examination of the SCC Decision in the light of Articles 7, 8 and 47 of the Charter has disclosed nothing to affect the validity of that decision.","paragraph_id":"para_707"},{"text":"The 4th, 5th, 9th and 10th questions","paragraph_id":"para_708"},{"text":"150","paragraph_id":"para_709"},{"text":"By its ninth question, the referring court wishes to know, in essence, whether and to what extent findings in the Privacy Shield Decision to the effect that the United States ensures an adequate level of protection are binding on the supervisory authority of a Member State. By its 4th, 5th and 10th …","paragraph_id":"para_710"},{"text":"151","paragraph_id":"para_711"},{"text":"As a preliminary matter, it should be noted that, although the Commissioner’s action in the main proceedings only calls into question the SCC Decision, that action was brought before the referring court prior to the adoption of the Privacy Shield Decision. In so far as, by its fourth and fifth quest …","paragraph_id":"para_712"},{"text":"152","paragraph_id":"para_713"},{"text":"In addition, it is clear from the information provided in the order for reference that, in the main proceedings, Facebook Ireland claims that the Privacy Shield Decision is binding on the Commissioner in respect of the finding on the adequacy of the level of protection ensured by the United States and therefore in respect of the lawfulness of a transfer to that third country of personal data pursuant to the standard data protection clauses in the annex to the SCC Decision.","paragraph_id":"para_714"},{"text":"153","paragraph_id":"para_715"},{"text":"As appears from paragraph 59 above, in its judgment of 3 October 2017, provided in an annex to the order for reference, the referring court stated that it was obliged to take account of amendments to the law that may have occurred in the interval between the institution of the proceedings and the he …","paragraph_id":"para_716"},{"text":"154","paragraph_id":"para_717"},{"text":"In particular, the question whether the finding in the Privacy Shield Decision that the United States ensures an adequate level of protection is binding is relevant for the purposes of assessing both the obligations, set out in paragraphs 141 and 142 above, of the controller and recipient of persona …","paragraph_id":"para_718"},{"text":"155","paragraph_id":"para_719"},{"text":"As to whether the Privacy Shield Decision has binding effects, Article 1(1) of that decision provides that, for the purposes of Article 45(1) of the GDPR, ‘the United States ensures an adequate level of protection for personal data transferred from the [European] Union to organisations in the United …","paragraph_id":"para_720"},{"text":"156","paragraph_id":"para_721"},{"text":"As follows from the case-law set out in paragraphs 117 and 118 above, the Privacy Shield Decision is binding on the supervisory authorities in so far as it finds that the United States ensures an adequate level of protection and, therefore, has the effect of authorising personal data transferred und …","paragraph_id":"para_722"},{"text":"157","paragraph_id":"para_723"},{"text":"The fact remains that, in accordance with the case-law set out in paragraphs 119 and 120 above, when a person lodges a complaint with the competent supervisory authority, that authority must examine, with complete independence, whether the transfer of personal data at issue complies with the require …","paragraph_id":"para_724"},{"text":"158","paragraph_id":"para_725"},{"text":"A complaint lodged under Article 77(1) of the GDPR, by which a person whose personal data has been or could be transferred to a third country contends that, notwithstanding what the Commission has found in a decision adopted pursuant to Article 45(3) of the GDPR, the law and practices of that countr …","paragraph_id":"para_726"},{"text":"159","paragraph_id":"para_727"},{"text":"In the present case, in essence, Mr Schrems requested the Commissioner to prohibit or suspend the transfer by Facebook Ireland of his personal data to Facebook Inc., established in the United States, on the ground that that third country did not ensure an adequate level of protection. Following an i …","paragraph_id":"para_728"},{"text":"160","paragraph_id":"para_729"},{"text":"As the Advocate General observed in point 175 of his Opinion, those questions must therefore be regarded, in essence, as calling into question the Commission’s finding, in the Privacy Shield Decision, that the United States ensures an adequate level of protection of personal data transferred from the European Union to that third country, and, therefore, as calling into question the validity of that decision.","paragraph_id":"para_730"},{"text":"161","paragraph_id":"para_731"},{"text":"In the light of the considerations set out in paragraphs 121 and 157 to 160 above and in order to give the referring court a full answer, it should therefore be examined whether the Privacy Shield Decision complies with the requirements stemming from the GDPR read in the light of the Charter (see, by analogy, judgment of 6 October 2015, Schrems, C‑362/14 , EU:C:2015:650 , paragraph  67 ).","paragraph_id":"para_732"},{"text":"162","paragraph_id":"para_733"},{"text":"In order for the Commission to adopt an adequacy decision pursuant to Article 45(3) of the GDPR, it must find, duly stating reasons, that the third country concerned in fact ensures, by reason of its domestic law or its international commitments, a level of protection of fundamental rights essential …","paragraph_id":"para_734"},{"text":"The Privacy Shield Decision","paragraph_id":"para_735"},{"text":"163","paragraph_id":"para_736"},{"text":"The Commission found, in Article 1(1) of the Privacy Shield Decision, that the United States ensures an adequate level of protection for personal data transferred from the Union to organisations in the United States under the EU-US Privacy Shield, the latter being comprised, inter alia, under Articl …","paragraph_id":"para_737"},{"text":"164","paragraph_id":"para_738"},{"text":"However, the Privacy Shield Decision also states, in paragraph I.5. of Annex II, under the heading ‘EU-U.S. Privacy Shield Framework Principles’, that adherence to those principles may be limited, inter alia, ‘to the extent necessary to meet national security, public interest, or law enforcement req …","paragraph_id":"para_739"},{"text":"165","paragraph_id":"para_740"},{"text":"In the light of its general nature, the derogation set out in paragraph I.5 of Annex II to the Privacy Shield Decision thus enables interference, based on national security and public interest requirements or on domestic legislation of the United States, with the fundamental rights of the persons wh …","paragraph_id":"para_741"},{"text":"166","paragraph_id":"para_742"},{"text":"In that context, in recitals 67 to 135 of the Privacy Shield Decision, the Commission assessed the limitations and safeguards available in US law, inter alia under Section 702 of the FISA, E.O. 12333 and PPD‑28, as regards access to, and use of, personal data transferred under the EU-US Privacy Shield by US public authorities for national security, law enforcement and other public interest purposes.","paragraph_id":"para_743"},{"text":"167","paragraph_id":"para_744"},{"text":"Following that assessment, the Commission found, in recital 136 of that decision, that ‘the United States ensures an adequate level of protection for personal data transferred from the [European] Union to self-certified organisations in the United States’, and, in recital 140 of the decision, it con …","paragraph_id":"para_745"},{"text":"The finding of an adequate level of protection","paragraph_id":"para_746"},{"text":"168","paragraph_id":"para_747"},{"text":"In the light of the factors mentioned by the Commission in the Privacy Shield Decision and the referring court’s findings in the main proceedings, the referring court harbours doubts as to whether US law in fact ensures the adequate level of protection required under Article 45 of the GDPR, read in …","paragraph_id":"para_748"},{"text":"169","paragraph_id":"para_749"},{"text":"As regards, in the first place, Articles 7 and 8 of the Charter, which contribute to the level of protection required within the European Union, compliance with which must be established by the Commission before it adopts an adequacy decision under Article 45(1) of the GDPR, it must be borne in mind …","paragraph_id":"para_750"},{"text":"170","paragraph_id":"para_751"},{"text":"Thus, access to a natural person’s personal data with a view to its retention or use affects the fundamental right to respect for private life guaranteed in Article 7 of the Charter, which concerns any information relating to an identified or identifiable individual. Such processing of data also fal …","paragraph_id":"para_752"},{"text":"171","paragraph_id":"para_753"},{"text":"The Court has held that the communication of personal data to a third party, such as a public authority, constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, whatever the subsequent use of the information communicated. The same is true of the retentio …","paragraph_id":"para_754"},{"text":"172","paragraph_id":"para_755"},{"text":"However, the rights enshrined in Articles 7 and 8 of the Charter are not absolute rights, but must be considered in relation to their function in society (see, to that effect, judgments of 9 November 2010, Volker und Markus Schecke and Eifert, C‑92/09 and C‑93/09 , EU:C:2010:662 , paragraph  48 and …","paragraph_id":"para_756"},{"text":"173","paragraph_id":"para_757"},{"text":"In this connection, it should also be observed that, under Article 8(2) of the Charter, personal data must, inter alia, be processed ‘for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law’.","paragraph_id":"para_758"},{"text":"174","paragraph_id":"para_759"},{"text":"Furthermore, in accordance with the first sentence of Article 52(1) of the Charter, any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms. Under the second sentence of Article 52(1) of the …","paragraph_id":"para_760"},{"text":"175","paragraph_id":"para_761"},{"text":"Following from the previous point, it should be added that the requirement that any limitation on the exercise of fundamental rights must be provided for by law implies that the legal basis which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned (Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph  139 and the case-law cited).","paragraph_id":"para_762"},{"text":"176","paragraph_id":"para_763"},{"text":"Lastly, in order to satisfy the requirement of proportionality according to which derogations from and limitations on the protection of personal data must apply only in so far as is strictly necessary, the legislation in question which entails the interference must lay down clear and precise rules g …","paragraph_id":"para_764"},{"text":"177","paragraph_id":"para_765"},{"text":"To that effect, Article 45(2)(a) of the GDPR states that, in its assessment of the adequacy of the level of protection in a third country, the Commission is, in particular, to take account of ‘effective and enforceable data subject rights’ for data subjects whose personal data are transferred.","paragraph_id":"para_766"},{"text":"178","paragraph_id":"para_767"},{"text":"In the present case, the Commission’s finding in the Privacy Shield Decision that the United States ensures an adequate level of protection for personal data essentially equivalent to that guaranteed in the European Union by the GDPR, read in the light of Articles 7 and 8 of the Charter, has been ca …","paragraph_id":"para_768"},{"text":"179","paragraph_id":"para_769"},{"text":"In that regard, as regards the surveillance programmes based on Section 702 of the FISA, the Commission found, in recital 109 of the Privacy Shield Decision, that, according to that article, ‘the FISC does not authorise individual surveillance measures; rather, it authorises surveillance programs (l …","paragraph_id":"para_770"},{"text":"180","paragraph_id":"para_771"},{"text":"It is thus apparent that Section 702 of the FISA does not indicate any limitations on the power it confers to implement surveillance programmes for the purposes of foreign intelligence or the existence of guarantees for non-US persons potentially targeted by those programmes. In those circumstances …","paragraph_id":"para_772"},{"text":"181","paragraph_id":"para_773"},{"text":"According to the findings in the Privacy Shield Decision, the implementation of the surveillance programmes based on Section 702 of the FISA is, indeed, subject to the requirements of PPD‑28. However, although the Commission stated, in recitals 69 and 77 of the Privacy Shield Decision, that such req …","paragraph_id":"para_774"},{"text":"182","paragraph_id":"para_775"},{"text":"As regards the monitoring programmes based on E.O. 12333, it is clear from the file before the Court that that order does not confer rights which are enforceable against the US authorities in the courts either.","paragraph_id":"para_776"},{"text":"183","paragraph_id":"para_777"},{"text":"It should be added that PPD‑28, with which the application of the programmes referred to in the previous two paragraphs must comply, allows for ‘“bulk” collection … of a relatively large volume of signals intelligence information or data under circumstances where the Intelligence Community cannot us …","paragraph_id":"para_778"},{"text":"184","paragraph_id":"para_779"},{"text":"It follows therefore that neither Section 702 of the FISA, nor E.O. 12333, read in conjunction with PPD‑28, correlates to the minimum safeguards resulting, under EU law, from the principle of proportionality, with the consequence that the surveillance programmes based on those provisions cannot be regarded as limited to what is strictly necessary.","paragraph_id":"para_780"},{"text":"185","paragraph_id":"para_781"},{"text":"In those circumstances, the limitations on the protection of personal data arising from the domestic law of the United States on the access and use by US public authorities of such data transferred from the European Union to the United States, which the Commission assessed in the Privacy Shield Deci …","paragraph_id":"para_782"},{"text":"186","paragraph_id":"para_783"},{"text":"In the second place, as regards Article 47 of the Charter, which also contributes to the required level of protection in the European Union, compliance with which must be determined by the Commission before it adopts an adequacy decision pursuant to Article 45(1) of the GDPR, it should be noted that …","paragraph_id":"para_784"},{"text":"187","paragraph_id":"para_785"},{"text":"According to settled case-law, the very existence of effective judicial review designed to ensure compliance with provisions of EU law is inherent in the existence of the rule of law. Thus, legislation not providing for any possibility for an individual to pursue legal remedies in order to have acce …","paragraph_id":"para_786"},{"text":"188","paragraph_id":"para_787"},{"text":"To that effect, Article 45(2)(a) of the GDPR requires the Commission, in its assessment of the adequacy of the level of protection in a third country, to take account, in particular, of ‘effective administrative and judicial redress for the data subjects whose personal data are being transferred’. R …","paragraph_id":"para_788"},{"text":"189","paragraph_id":"para_789"},{"text":"The existence of such effective redress in the third country concerned is of particular importance in the context of the transfer of personal data to that third country, since, as is apparent from recital 116 of the GDPR, data subjects may find that the administrative and judicial authorities of the …","paragraph_id":"para_790"},{"text":"190","paragraph_id":"para_791"},{"text":"In the present case, the Commission’s finding in the Privacy Shield Decision that the United States ensures a level of protection essentially equivalent to that guaranteed in Article 47 of the Charter has been called into question on the ground, inter alia, that the introduction of a Privacy Shield …","paragraph_id":"para_792"},{"text":"191","paragraph_id":"para_793"},{"text":"In that regard, the Commission found, in recital 115 of the Privacy Shield Decision, that ‘while individuals, including EU data subjects, … have a number of avenues of redress when they have been the subject of unlawful (electronic) surveillance for national security purposes, it is equally clear th …","paragraph_id":"para_794"},{"text":"192","paragraph_id":"para_795"},{"text":"Furthermore, as regards both the surveillance programmes based on Section 702 of the FISA and those based on E.O. 12333, it has been noted in paragraphs 181 and 182 above that neither PPD‑28 nor E.O. 12333 grants data subjects rights actionable in the courts against the US authorities, from which it follows that data subjects have no right to an effective remedy.","paragraph_id":"para_796"},{"text":"193","paragraph_id":"para_797"},{"text":"The Commission found, however, in recitals 115 and 116 of the Privacy Shield Decision, that, as a result of the Ombudsperson Mechanism introduced by the US authorities, as described in a letter from the US Secretary of State to the European Commissioner for Justice, Consumers and Gender Equality fro …","paragraph_id":"para_798"},{"text":"194","paragraph_id":"para_799"},{"text":"An examination of whether the ombudsperson mechanism which is the subject of the Privacy Shield Decision is in fact capable of addressing the Commission’s finding of limitations on the right to judicial protection must, in accordance with the requirements arising from Article 47 of the Charter and t …","paragraph_id":"para_800"},{"text":"195","paragraph_id":"para_801"},{"text":"In the letter referred to in paragraph 193 above, the Privacy Shield Ombudsperson, although described as ‘independent from the Intelligence Community’, was presented as ‘[reporting] directly to the Secretary of State who will ensure that the Ombudsperson carries out its function objectively and free …","paragraph_id":"para_802"},{"text":"196","paragraph_id":"para_803"},{"text":"Similarly, as the Advocate General stated, in point 338 of his Opinion, although recital 120 of the Privacy Shield Decision refers to a commitment from the US Government that the relevant component of the intelligence services is required to correct any violation of the applicable rules detected by …","paragraph_id":"para_804"},{"text":"197","paragraph_id":"para_805"},{"text":"Therefore, the ombudsperson mechanism to which the Privacy Shield Decision refers does not provide any cause of action before a body which offers the persons whose data is transferred to the United States guarantees essentially equivalent to those required by Article 47 of the Charter.","paragraph_id":"para_806"},{"text":"198","paragraph_id":"para_807"},{"text":"Therefore, in finding, in Article 1(1) of the Privacy Shield Decision, that the United States ensures an adequate level of protection for personal data transferred from the Union to organisations in that third country under the EU-US Privacy Shield, the Commission disregarded the requirements of Article 45(1) of the GDPR, read in the light of Articles 7, 8 and 47 of the Charter.","paragraph_id":"para_808"},{"text":"199","paragraph_id":"para_809"},{"text":"It follows that Article 1 of the Privacy Shield Decision is incompatible with Article 45(1) of the GDPR, read in the light of Articles 7, 8 and 47 of the Charter, and is therefore invalid.","paragraph_id":"para_810"},{"text":"200","paragraph_id":"para_811"},{"text":"Since Article 1 of the Privacy Shield Decision is inseparable from Articles 2 and 6 of, and the annexes to, that decision, its invalidity affects the validity of the decision in its entirety.","paragraph_id":"para_812"},{"text":"201","paragraph_id":"para_813"},{"text":"In the light of all of the foregoing considerations, it is to be concluded that the Privacy Shield Decision is invalid.","paragraph_id":"para_814"},{"text":"202","paragraph_id":"para_815"},{"text":"As to whether it is appropriate to maintain the effects of that decision for the purposes of avoiding the creation of a legal vacuum (see, to that effect, judgment of 28 April 2016, Borealis Polyolefine and Others, C‑191/14, C‑192/14, C‑295/14, C‑389/14 and C‑391/14 to C‑393/14 , EU:C:2016:311 , par …","paragraph_id":"para_816"},{"text":"Costs","paragraph_id":"para_817"},{"text":"203","paragraph_id":"para_818"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_819"},{"text":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraph_id":"para_820"},{"text":"1.","paragraph_id":"para_821"},{"text":"Article 2(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulat …","paragraph_id":"para_822"},{"text":"2.","paragraph_id":"para_823"},{"text":"Article 46(1) and Article 46(2)(c) of Regulation 2016/679 must be interpreted as meaning that the appropriate safeguards, enforceable rights and effective legal remedies required by those provisions must ensure that data subjects whose personal data are transferred to a third country pursuant to sta …","paragraph_id":"para_824"},{"text":"3.","paragraph_id":"para_825"},{"text":"Article 58(2)(f) and (j) of Regulation 2016/679 must be interpreted as meaning that, unless there is a valid European Commission adequacy decision, the competent supervisory authority is required to suspend or prohibit a transfer of data to a third country pursuant to standard data protection clause …","paragraph_id":"para_826"},{"text":"4.","paragraph_id":"para_827"},{"text":"Examination of Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EU of the European Parliament and of the Council, as amended by Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights has disclosed nothing to affect the validity of that decision.","paragraph_id":"para_828"},{"text":"5.","paragraph_id":"para_829"},{"text":"Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield is invalid.","paragraph_id":"para_830"},{"text":"Lenaerts","paragraph_id":"para_831"},{"text":"Silva de Lapuerta","paragraph_id":"para_832"},{"text":"Arabadjiev","paragraph_id":"para_833"},{"text":"Prechal","paragraph_id":"para_834"},{"text":"Vilaras","paragraph_id":"para_835"},{"text":"Safjan","paragraph_id":"para_836"},{"text":"Rodin","paragraph_id":"para_837"},{"text":"Xuereb","paragraph_id":"para_838"},{"text":"Rossi","paragraph_id":"para_839"},{"text":"Jarukaitis","paragraph_id":"para_840"},{"text":"Ilešič","paragraph_id":"para_841"},{"text":"von Danwitz","paragraph_id":"para_842"},{"text":"Šváby","paragraph_id":"para_843"},{"text":"Delivered in open court in Luxembourg on 16 July 2020.","paragraph_id":"para_844"},{"text":"A. Calot Escobar","paragraph_id":"para_845"},{"text":"Registrar","paragraph_id":"para_846"},{"text":"K. Lenaerts","paragraph_id":"para_847"},{"text":"President","paragraph_id":"para_848"},{"text":"(\n *1\n ) Language of the case: English.","paragraph_id":"para_849"}],"word_count":27761,"cites":["C-362/14","C-897/19","C-62/14","C-207/16","C-16/18","C-507/17","C-673/17","C-25/17","C-617/10","C-524/15","C-135/15","C-92/09","C-93/09","C-293/12","C-594/12","C-465/00","C-138/01","C-139/01","C-291/12","C-274/14","C-191/14","C-192/14","C-295/14","C-389/14","C-391/14","C-393/14"],"sha256":"8a74f1251938ffdc38cb36631f3358dc0db68602a3f479726db70c2f68465059","source_url":"https://publications.europa.eu/resource/celex/62018CJ0311.ENG.xhtml.ECR_62018CJ0311_EN_01.html","fetched_at":"2026-09-30T07:58:13.57+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-311-18-62018cj0311","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-311-18-62018cj0311","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-311-18-62018cj0311","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-311-18-62018cj0311","verification":{"stored_sha256":"8a74f1251938ffdc38cb36631f3358dc0db68602a3f479726db70c2f68465059","recomputed_sha256":"8a74f1251938ffdc38cb36631f3358dc0db68602a3f479726db70c2f68465059","intact":true,"checked_at":"2026-10-15T07:27:46.981Z"}},"hash":"sha256:744ad86498a4f7850f348fdb4e0e5908026aced73d7fb0346cbbbde551a30fcd","version":"legal-2026-10-15","expires":"2026-10-16T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-15+legal-2026-10-15+2026-10-15T06:23:03","content_hash":"sha256:744ad86498a4f7850f348fdb4e0e5908026aced73d7fb0346cbbbde551a30fcd","revalidate_after":"2026-10-15T08:27:47.658Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-311-18-62018cj0311","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-311-18-62018cj0311"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-311-18-62018cj0311"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-311-18-62018cj0311"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":6},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-311-18-62018cj0311","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-dad4ea1409387a2f14ebd37fdf385057","response_hash":"sha256:744ad86498a4f7850f348fdb4e0e5908026aced73d7fb0346cbbbde551a30fcd"}},"freshness":{"freshness_class":"live","as_of":"2026-11-04T05:50:36.581Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-311-18-62018cj0311&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":52568}}