Skip to content

EU Court Upholds US Data Protection Adequacy in Landmark 'Schrems II' Case

The EU's top court clears the way for transatlantic data transfers. It dismisses concerns about US intelligence practices and the independence of the Data Protection Review Court.

In the picture there is a data card connected to a laptop.
In the picture there is a data card connected to a laptop.

EU Court Upholds US Data Protection Adequacy in Landmark 'Schrems II' Case

On July 16, 2020, the Court of Justice of the European Union (CJEU) delivered its judgment in the high-profile case of Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems, commonly known as 'Schrems II'. The case challenged the adequacy of protection guarantees for personal data transferred from the EU to the USA.

The CJEU ruled that the USA ensures an 'adequate level of protection' for personal data transferred from the EU. The court found that the appointment of judges and operations of the Data Protection Review Court (DPRC) in the USA are subject to several guarantees and conditions that ensure the independence of its members.

The plaintiff, a French citizen, argued that the DPRC is not independent and that US intelligence agencies' data collection practices are unlawful. However, the European Union's court dismissed the lawsuit, finding no violation of the requirements of previous judgments. The court confirmed that the level of legal protection in the USA is equivalent to that guaranteed by EU law. It also noted the existence of a post-hoc judicial review by the DPRC regarding the mass collection of personal data.

The CJEU's judgment in Schrems II upholds the adequacy of data protection in the USA, ensuring that personal data transferred from the EU to USA organizations maintains an equivalent level of legal protection. The court's decision clears the way for continued transatlantic data transfers under the new framework.

Read also:

Latest