The European Court of Justice’s (ECJ) Grand Chamber, in case C-311/18 Data Protection Commissioner v. Facebook Ireland Ltd. and Maximilian Schrems (intervening parties: the USA, Electronic Privacy Information Centre, BSA Business Software Alliance Inc. and Digitaleurope), has invalidated Commission Decision 2016/1250 (The Privacy Shield Decision), while maintaining valid Commission Decision 2010/87 on Standard Contractual Clauses (SCCs Decision).

The judgement stemmed from Mr Schrems’s complaint with the Irish Supervisory Authority whereby he requested that Facebook Ireland be prohibited from transferring his personal data to the US, on the ground that the law and practice in force in that country did not ensure adequate protection of the personal data held in its territory against the surveillance activities in which the public authorities were engaged.

Download the document