The EU-US "Safe Harbor" scheme is invalid: the CJEU decision in Schrems

United Kingdom

This article was produced by Nabarro LLP, which joined CMS on 1 May 2017.

On 6 October, the CJEU gave a landmark ruling in the case known as Schrems v Facebook (Schrems C-362/14).  The decision upheld the Advocate General's Opinion that the current legal regime that permits transfers of personal data from the EU to companies in the US, the so-called Safe Harbor Agreement, is invalid.  

This is likely to have an impact on any company that transfers personal data from the EU to the US that relies solely on the scheme.  However, there are other options under EU legislation that allow for the lawful transfer of personal data from the EU to the US.

UPDATE: We have prepared an alert on this decision which can be accessed here.