Schrems II
CJEU C-311/18 — Privacy Shield invalidated, SCCs + TIA mandatory
TL;DR
Schrems II (CJEU C-311/18 of 16 July 2020) invalidated the EU-US Privacy Shield. As a consequence, data transfers to third countries (outside the EU/EEA) may only take place subject to additional safeguards — typically standard contractual clauses (SCC 2021/914) plus a Transfer Impact Assessment (TIA). The Data Privacy Framework (DPF, in force since 07/2023) provides a new Privacy-Shield-equivalent for US transfers.
What is Schrems II?
Four main pillars after Schrems II:
- SCC 2021/914 as a standard safeguard for third-country transfers
- Transfer Impact Assessment (TIA): assessment of the third country's level of protection plus additional measures where necessary
- Data Privacy Framework (DPF): adequacy decision for certified US companies (in force since 07/2023, confirmed by the General Court in T-553/23 of 09/2025)
- Binding Corporate Rules (BCRs) for intra-group transfers
Practical example
Practical case: Microsoft 365 with US subsidiary MS Inc. as a sub-processor. - DPA with Microsoft (EU contracting party) - SCC annex for the US transfer - TIA: take into account Trump 2024 decisions and FISA Section 702 - Alternative: DPF — Microsoft Inc. is DPF-certified - In practice: dual track (DPF + SCC) as risk mitigation