The initial assessment stems from a case brought by Max Schrems, an Austrian privacy activist who successfully had the EU-US Safe Harbor agreement struck down in 2015.
In the current case, Schrems objected to his data being transferred from Facebook Ireland to Facebook Inc in the US under the terms of the EU’s General Data Protection Regulation. Schrems lodged a complaint with the Data Protection Commissioner in Ireland, which in turn filed a case before the High Court of Ireland.
The High Court asked the European Court of Justice if the boilerplate contracts used by online services that transfer personal data to the US and elsewhere sufficiently protect European citizens.
On Thursday, Henrik Saugmandsgaard Øe, an advocate general at the ECJ, said that “standard contractual clauses for the transfer of personal data to processors established in third countries is valid,” according to a court press release.
The Schrems complaint “disclosed nothing” that should change established EU procedures on personal data being sent to the US or other non-EU countries, he advised. The advocate general said the use of “standard contractual clauses” was consistent with the GDPR and that GDPR applied to how European outfits operate, not how rules are enforced outside the bloc.
Schrems issued a short press statement following the ruling. It read (in its entirety):
“The advocate general at the CJEU has today issued a non-binding advisory opinion on EU-US data transfers in the light of the cooperation of Facebook with the NSA and the resulting US mass surveillance. This is already the second reference to the CJEU in this case. The first ruling by the CJEU has resulted in the striking down of the previous EU-US ‘Safe Harbor’ agreement. The final ruling by the CJEU in this second reference is expected within the next months. The CJEU is not bound by today’s opinion of the advocate general.”
Jack Gilbert, associate general counsel at Facebook, said in a statement to Delano:
“We are grateful for the advocate general’s opinion on these complex questions. Standard contractual clauses provide important safeguards to ensure that Europeans’ data are protected once transferred overseas. SCCs have been designed and endorsed by the European Commission and enable thousands of Europeans to do business worldwide. We look forward to the final decision from the CJEU.”
The advocate general’s opinion is non-binding. The matter will now be considered by a panel of ECJ judges. In the vast majority of cases, they reach the same conclusion as advocates general.
The case is C-311/18 Facebook Ireland and Schrems.