Review of EU standard contractual clauses by the ECJ

The European Court of Justice will soon also examine the EU standard contractual clauses, which enable data transfers outside the EU/EEA to be secured, with regard to their admissibility under data protection law. This can have a significant impact on international data transfers. The Irish High Court decided on 03.10.2017 to have the question of the admissibility of standard contractual clauses clarified by the European Court of Justice. Although the standard contractual clauses would have been revised anyway due to the entry into force of the GDPR, it may now be necessary to amend the clauses sooner than expected – depending on the duration of the proceedings at the ECJ.

The submission had been expected after the ECJ ruled in its judgment of 06.10.2015 – C-362/14 that the Safe Harbour agreement violated the EU Charter of Fundamental Rights and therefore data transfers to the USA could not be based on it. The group europe-vs-facebook.org, which had already brought down Safe Harbour, is now taking action against the use of the standard contractual clauses. This procedure can potentially result in significantly more extensive frictions than the earlier safe harbor decision. This is because standard contractual clauses are used not only in dealings with the U.S., but also with any other third country outside the European Economic Area, and are of considerable importance in practice.

At least for a data transfer to the U.S., it may therefore already make sense to base the data transfer on the EU-US Privacy Shield, which contains newer and more far-reaching regulations to ensure an appropriate level of data protection. For the time being, the EU standard contractual clauses can continue to be used, but further developments must be monitored.

If you have any questions regarding the implementation of data protection requirements for third-country transfers, please feel free to contact our data protection contacts.