Privacy Laws
Schrems II (Case C-311/18)
The Court of Justice judgment that invalidated the EU-US Privacy Shield and required a case-by-case assessment of transfers to the United States.
The chain of cases
| Case | Date | Outcome |
|---|---|---|
| C-362/14 (Schrems I) | 6 October 2015 | Safe Harbor invalidated |
| Privacy Shield Decision 2016/1707 | 2016 | New adequacy decision for the United States |
| C-311/18 (Schrems II) | 16 July 2018 | Privacy Shield invalidated |
What the 2018 judgment actually held
The question referred was narrow: whether the Standard Contractual Clauses could continue to be used for transfers to a third country where the legal system of that country prevents compliance.
The Court held that they cannot, on their own, and that a transfer requires a verifiable finding that the importer will in practice respect the clauses. Where the destination country’s law allows authorities to compel access to data and imposes obligations directly on the importer, the SCCs require the exporter to assess that law and to suspend the transfer if protection is not ensured.
What followed
- The EU-US Privacy Shield framework was replaced by the EU-US Data Privacy Framework adequacy decision, which relies on a different legal instrument.
- The 2021 SCCs replaced the earlier ones, with clauses intended to address the issue the judgment identified.
- A data protection authority may require an exporter to suspend or prohibit a transfer where the assessment does not conclude that protection is ensured.
- The tension between the judgment’s reasoning and the later adequacy decision remains the subject of pending litigation, which is why this entry’s status is not recorded as finally settled.
Limits of this entry
This entry summarises what the judgment held. It does not assess the current state of litigation, which changes. Check the Court of Justice case record for the authoritative text and any subsequent references.
Sources
- C-311/18, judgment of 16 July 2018 — the primary record.
- C-362/14, judgment of 6 October 2015 — Safe Harbor.
- Commission Implementing Decision (EU) 2021/914 — the current standard contractual clauses.
Claim labels
FACT
The judgment was delivered on 16 July 2018 in Case C-311/18, Schrems v Data Protection Commissioner.
FACT
The Court held the EU-US Privacy Shield Decision (Commission Implementing Decision (EU) 2016/1707) invalid.
FACT
The Court held that the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are not sufficient in themselves where the importer is subject to surveillance measures that conflict with them.
FACT
The Court held that the supervisory authority must suspend or prohibit a transfer where equivalent protection cannot be ensured.
FACT
The operative part of the judgment was 96 pages. Paragraph 133 is frequently cited for the assessment of third-country law.
SOURCE CLAIM
The European Commission and data protection authorities have described the resulting assessment procedure as workable and as a "robust" mechanism. Those are institutional characterisations, not findings in the judgment.
Sources
Last link check: 2026-09-27. A link check confirms reachability, not that every claim has been independently reviewed.
- Judgment of 16 July 2018, Schrems v Data Protection Commissioner, C-311/18 Accessed
- Judgment of 6 October 2015, Schrems v Data Protection Commissioner, C-362/14 The earlier judgment that struck down Safe Harbor. Accessed
- Commission Implementing Decision (EU) 2021/914 on standard contractual clauses Accessed