Disclaimer

The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Irish High Court grants the Data Protection Commissioner its CJEU referral in DPC v Facebook Ireland and Maximilian Schrems

 

The Commissioner welcomes the High Court’s judgment and its decision to refer a number of questions to the CJEU, as requested by the Commissioner.

The transfer of personal data to the US under the standard contractual clauses mechanism (“SCCs”) raises important issues for the protection of EU citizens’ data protection rights. Now that the High Court has confirmed it shares the Commissioner’s concerns about the protection of those rights in the context of EU/US data transfers, the Commissioner hopes these issues will be addressed by the CJEU as soon as possible to provide certainty for data subjects and controllers alike. In that context, the Commissioner acknowledges that many businesses rely on SCCs to transfer data from the EU to the US. It is important to note that today’s decision does not invalidate the SCCs {nor the Privacy Shield); neither does it prohibit their continued use for the purpose of data transfers to the US or elsewhere. Rather, it invites the CJEU to consider whether, under EU law, SCCs in their present form can and should be retained as a basis for the transfer of personal data from the EU to the US.

 

Judgement

 

Executive Summary