An assessment of the impact of the Schrems judgement on the data transfer grounds available under EU data protection law for data transfers to the U.S.

An assessment of the impact of the Schrems judgement on the data transfer grounds available under EU data protection law for data transfers to the U.S.The purpose of this memorandum is to examine the export of personal data by data controllers established in the EU to countries outside of the EU, 1 in particular to the United States, in light of the judgment of the Court of Justice of the European Union (CJEU) in Schrems v Data Protection Commissioner 2 (Schrems judgment). I.The EU data transfer regime 1.The general rule under EU Privacy Directive 95/46 (Directive) is that personal data can only be exported by a company established in the EU to third countries that provide an "adequate level of protection" for such data, unless certain conditions have been met (Article 25(1) of the Directive).Those conditions are split into two categories.(a) Transfers based on an "adequacy decision" (issued under Article 25(6) of the Directive): Article 25(6) of the Directive allows the Commission to find -via an "adequacy decision" -that certain legal regimes are 'adequate' when assessed against the standard set by EU data protection law.Specific jurisdictional adequacy decisions include those permitting data export to Canada, New Zealand and Israel. 3 Only a very limited number of countries have obtained an adequacy decision, and these do not include main trading partners of the EU, such as China, Japan, Russia, India, and Brazil.The procedure for countries to obtain an adequacy finding can take years and requires a full assessment by the Commission of the rule of law, access to justice as well as international human rights norms and standards in such country, which assessment further has to be revised on a regular basis. 4 (b) Specific data transfers grounds (regulated under Article 26 of the Directive): the general rule that personal data may only be exported from the EU to third countries that provide an "adequate level of protection" for such personal data is subject to a number of explicit "derogations".These derogations are set forth in Article 26 of the Directive, listing the circumstances in which a data exporter is permitted to transfer personal data from the 1The countries of the European Free Trade Association (EFTA (Iceland, Liechtenstein and Norway) have ratified the Directive.References to the EU should be understood to include the EFTA countries, i.e., they also concern the European Economic Area (EEA).

Récupéré en direct depuis OpenAlex et désinversé. Les résumés ne sont pas conservés dans cette base de données : les index inversés représentent 8,6 Go des 9,3 Go de texte de la base, et le serveur dispose de 13 Go libres.