What is Schrems II?

Schrems II is a landmark case before the European Court of Justice that invalidated the EU-US Privacy Shield Framework and imposed additional obligations for transfers of personal data from the EU to any country that does not benefit from an EU adequacy decision. There is a special list of adequate countries.

The case was brought by Maximilian Schrems, an Austrian lawyer and privacy activist.

Schrems II has significant implications for businesses processing personal data. The judgement declared that companies must comply with applicable EU law and must ensure an adequate level of data protection when transferring personal data to third countries (read as: outside of EU/EEA and adequate countries).

The essence of the Schrems II judgement is that businesses need to control in which country they store their customer’s personal data and, to which countries is this personal data transferred to, and from which countries it’s being accessed. Choosing a provider which can accommodate this will enable businesses to be compliant.

Schrems II benefits end-users by providing greater protection for their personal data. The ruling requires businesses to assess the risk associated with data transfers and implement measures that ensure the protection of personal data.

This means that end-users can have greater confidence in the businesses they interact with, knowing that their personal data is being accessed only from countries which provide adequate protection.

Schrems II is a significant ruling that has wide-ranging implications for businesses and end-users. By promoting greater accountability, the ruling has the potential to improve data protection practices and promote privacy rights. Businesses that comply with the ruling can build trust with customers and enhance their reputation in the marketplace. End-users can feel confident that their personal data is being protected, which can promote greater confidence and trust in the companies they interact with.