Security & governance
Schrems II
Schrems II is the judgment of the Court of Justice of the European Union of 16 July 2020 (case C-311/18) that invalidated the EU-US Privacy Shield, the mechanism many organizations relied on to send personal data to the United States. It kept standard contractual clauses valid but made their use conditional on a case-by-case assessment of the destination country's laws.
What did Schrems II decide?
The court held that US surveillance law did not give people in the EU protection essentially equivalent to that guaranteed under the GDPR, and that they lacked effective redress. The Privacy Shield adequacy decision was therefore invalid with immediate effect. Standard contractual clauses survived, but the exporter has to verify that the clauses can actually be honored in the destination country and add supplementary measures where they cannot, or stop the transfer.
What happened after Schrems II?
The ruling was the second of its kind and was followed by a new framework, which has itself been challenged.
| Date | Event | Effect |
|---|---|---|
| 2015 | Schrems I | Safe Harbor arrangement invalidated |
| July 2020 | Schrems II | Privacy Shield invalidated; contractual clauses conditional on assessment |
| July 2023 | EU-US Data Privacy Framework adopted | Transfers to certified US organizations permitted again |
| September 2025 | General Court judgment in the Latombe case | Challenge dismissed, framework upheld |
| October 2025 | Appeal lodged with the Court of Justice | Framework remains in force while the appeal is pending |
What are supplementary measures?
Where an assessment finds that foreign law could override the contractual clauses, the exporter must add technical, contractual or organizational measures. The technical ones carry the most weight: strong encryption where the keys stay with the exporter in the EU, as in hold your own key arrangements, or pseudonymization before data leaves. Encryption does not help if the provider needs the data in clear to deliver the service, which is the limit of the approach for many cloud applications.
What does Schrems II mean for storage?
The judgment turned the location and control of stored data into a compliance question. Each transfer mechanism has been challenged in court, so organizations with long retention periods cannot assume that the current framework will last as long as their data. That uncertainty is one reason behind data localization strategies and behind attention to laws such as the CLOUD Act, which can reach data held in the EU by providers under US jurisdiction. Keeping personal data on infrastructure operated under EU jurisdiction removes the transfer question for that data.
Frequently asked questions
Is the Privacy Shield still valid?
No. The Court of Justice invalidated it on 16 July 2020. The EU-US Data Privacy Framework replaced it in July 2023.
Are standard contractual clauses still valid after Schrems II?
Yes, but the exporter must assess the law of the destination country and add supplementary measures where needed.
Who is Schrems?
Max Schrems is an Austrian privacy campaigner whose complaints about transfers of his personal data to the United States led to both judgments.
Related terms
- GDPR: the regulation the judgment interprets.
- CLOUD Act: a US law relevant to transfer assessments.
- Extraterritorial data access: the underlying risk the court examined.
- Hold your own key (HYOK): a technical supplementary measure.
- Data localization: keeping data within a jurisdiction.