Schrems II and transatlantic data-transfer crisis

How Schrems II invalidated Privacy Shield and altered global cloud transfers

The 2020 Schrems II ruling exposed a conflict between European privacy rights and broad US government surveillance powers. Companies transferring European residents' personal data to American providers had relied on approved legal arrangements. The Court of Justice of the European Union concluded that the then-existing EU–US Privacy Shield did not provide the level of protection required by EU law. The judgment disrupted legal certainty for thousands of data transfers but did not ban all business with US service providers or automatically invalidate every standard contractual clause.

Austrian privacy campaigner Max Schrems had challenged Facebook Ireland's transfer of personal information to the United States. In 2015 the Court invalidated the older Safe Harbour arrangement following earlier litigation. The European Commission subsequently adopted the Privacy Shield adequacy decision in 2016 as its successor. The framework offered participating American firms a route to receive information from Europe, while critics questioned whether US intelligence surveillance law and remedies for EU residents had materially changed. The dispute reached the European Court of Justice again in case C-311/18.

On 16 July 2020 the Grand Chamber delivered its Schrems II judgment. It invalidated the Privacy Shield decision because access by American public authorities and available remedies were insufficient under European fundamental-rights requirements. Standard contractual clauses remained legally usable in principle, but exporters and importers had to assess whether destination-country law prevented compliance and adopt supplementary protections where necessary. Businesses operating global customer databases, software services or advertising systems faced the cost of documenting such assessments and potentially changing storage or encryption arrangements.

The judgment strengthened personal-data protection by making legal rights, government access and effective remedies central to transfer decisions rather than relying on an administrative badge alone. It also highlighted digital surveillance intensity: the dispute concerned the scale and safeguards of intelligence collection, not merely whether private firms posted a privacy notice. National data protection regulators began enforcing the resulting transfer obligations. The Irish Data Protection Commission published materials on the related proceedings and subsequent enforcement context.

In October 2022 the Biden administration issued an executive order intended to strengthen safeguards and provide a new review mechanism for eligible foreign complainants. On 10 July 2023 the European Commission adopted a new adequacy decision for the EU–US Data Privacy Framework. European Data Protection Board guidance published later explained practical consequences for businesses using the new system. These steps belong to digital-rights regulation but did not retrospectively validate transfers conducted in breach of the earlier legal requirements. They also did not eliminate the possibility of new legal challenges.

The criticism of the original arrangement concerned its inability to close an identified legal gap; the strongest counterargument to blanket localisation is that international services often require legitimate information transfers for commerce, science and communication. Schrems II forced each side to confront the discrepancy between those operational needs and enforceable individual protections. The key outcomes are observable in court decisions, regulatory guidance, corporate compliance costs and subsequent adequacy rulings rather than claims that transatlantic data exchange either ended or became automatically safe.