IDC Names Securiti a Worldwide Leader in Data Privacy


Schrems-II judgment opens door for complaints on EU-US transfers

Published September 2, 2020 / Updated November 22, 2023

Listen to the content

Things are getting serious for 101 EU data controllers sending data to the US – Max Schrems’ organization “NOYB” lodges complaints with various EU authorities

One month ago, the Court of Justice of the European Union (CJEU) delivered its "Schrems II" ruling (16 July 2020, C-311/18), thereby declaring the EU-US Privacy Shield invalid. Although the CJEU found the standard contractual clauses (SCC) remain valid, it pointed out that the formal conclusion of the SCC alone may not be sufficient to safeguard data transfers to so-called “third countries” outside the EU, particularly the US. Rather, the data exporter and data importer must ensure that the data is granted the same protection in the third country as it is within the EU under the GDPR and the EU Charter of Fundamental Rights.

Schrems-II judgment opens door for complaints on EU-US transfers

Max Schrems, the defendant in the proceedings which formed the basis for the Schrems II judgment, directly responded to the judgment. On his not-for-profit organization’s (NOYB – European Center for Digital Rights) website, he provided sample inquiries for companies as well as data subjects, which they can send to data processors and data controllers. The templates are used to request information on how the respective companies secure the transfer of data to third countries following the judgement.

Now the organization has filed 101 complaints with the relevant supervisory authorities against EU controllers that use Google Analytics and Facebook Connect integrations on their webpages. The affected controllers include large international companies from various business sectors. The complaints are identical in content. NOYB argues that the use of the Google and Facebook services requires the transfer of personal data to the USA. The parties, however, failed to implement adequate safeguards when continuing to transfer data to the US. Based on these arguments, NOYB requests that the authorities fully investigate the complaint and immediately impose a ban or suspension of any data transfers from the data controllers to Google and Facebook in the US and order the return of such data to the EU or another country that provides adequate protection. In addition, the supervisory authorities shall impose fines on the data controller as well as Google and Facebook.

It remains to be seen how the supervisory authorities deal with the complaints. Given their individual responsibilities, there is no obligation for the various EU regulators to develop a coordinated consolidated approach. Instead, it is possible that there will be different reactions from the authorities in the individual proceedings: In their initial comments, the supervisory authorities had expressed very different views on the Schrems II judgment. While some authorities stated that a transfer to a third country based on SCC alone was considered inadmissible, others took a much less strict view. The varying opinions will probably also be reflected in the responses to the complaints.

In any case, the complaint procedures and the resulting reactions of the supervisory authorities may serve as a guideline for other controllers and processors as to which measures must be taken in future to lawfully transfer data to third countries, especially the US.

Omer Imran Malik

Authored by Omer Imran Malik

Omer Imran Malik (CIPP/US, CIPM) is a data privacy and technology lawyer with significant experience in advising governments, technology companies, NGOs and legislative think-thanks on data privacy and technology related legal issues and is an expert in modeling legal models for legal technology. He has been a prominent contributor to numerous esteemed publications, including Dawn News, IAPP and has spoken at the World Ethical Data Forum as well.

His in-depth knowledge and extensive experience in the industry make him a trusted source for cutting-edge insights and information in the ever-evolving world of data privacy, technology and AI related legal developments.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


More Stories that May Interest You

On-Demand Webinar

Navigating the Impact of “Schrems II” and Cross-Border Data Transfers

Register Now
Michael Morgan

Michael Morgan

US Head Global Privacy & Cybersecurity Practice, McDermott Will & Emery

Srinivas Avasarala

Srinivas Avasarala

Vice President, Product Management, Securiti

At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.


Gartner Cool Vendor Award Forrester Badge IAPP Innovation award 2020 IDC Worldwide Leader RSAC Leader CBInsights Forbes Security Forbes Machine Learning G2 Users Most Likely To Recommend