The EU Court of Justice's advocate-general has upheld the use of standard contract clauses to ensure international transfers of personal data adhere to EU privacy standards. However, in the latest development in the case of Max Schrems versus Facebook, the court said that companies using the clauses should abandon the practice if the destination country for their data was found to provide inadequate protection of personal data.
The opinion was issued by advocate-general Saugmandsgaard Oo on questions posed by the High Court of Ireland on behalf of the Irish data protection regulator. The latter has authority over Facebook in the EU and is investigating a complaint from Schrems that Facebook violates EU privacy law by sending data on users to the US where they may be subject to state surveillance.
The standard contractual clauses allow companies to transfer personal data outside the EU even if the European Commission has not delivered a so-called adequacy decision on the destination country, that it meets EU privacy standards. Many companies rely on these clauses for transfers to the US, especially after Schrems succeeded in having the US's original 'safe habour' status removed by the EU court.
The Irish authority is now reconsidering Schrems' complaint after the EU court ruling in 2015. Schrems claims that Facebook's contract with users is not consistent with the Commission's decision of 2010 on the standard contractual clauses, and even if it were, this would not be enough to justify the transfer of his personal data to the US. He wants the regulator to suspend such data transfers, as non-US citizens have no legal recourse in the US if their privacy is violated there.
The advocate-general upheld the Commission's decision on the use of the clauses, saying this was a valid means to ensuring general application of the data protection rules. He noted though that this does not exempt companies or regulators from their duty to ensure that data protection is actually enforced in the destination countries. If a country is found to violate the EU principles, then the use of such clauses should be ended and the regulators need to act to stop the data transfers.
The AG's opinion is not binding, but the court tends to follow its recommendations in the final ruling. The opinion was welcomed by the Computer and Communications Industry Association, which noted that "Standard Contractual Clauses are the only viable and affordable instrument for European companies to transfer data beyond the dozen countries the EU deems adequate”.
Schrems said in a first reaction that he was generally pleased with the AD's opinion, which tended to follow his legal arguments. He called on the Irish Data Protection Commissioner to act and suspend the transfers to the US. "The opinion makes clear that DPC has the solution to this case in her own hands: She can order Facebook to stop transfers tomorrow. Instead, she turned to the CJEU to invalidate the whole system. It’s like screaming for the European fire brigade, because you don’t know how to blow out a candle yourself."
