Maximilian Schrems – CJEU Judgment (Ireland, 2015)
CJEU precedent (Directive 95/46/EC, pre-GDPR)
This is a Court of Justice judgment predating the GDPR. It interprets Directive 95/46/EC (the Data Protection Directive). It is not a cookie or ePrivacy case and is excluded from cookie statistics and the Risk Calculator.
The Court of Justice looked into whether EU data protection rules allowed data transfers to the US under the Safe Harbor agreement due to concerns about US surveillance. The case raised questions about the adequacy of US data protection for EU citizens. This case was crucial as it led to the invalidation of the Safe Harbor agreement, impacting international data transfers.
What happened
The Court assessed the legality of transferring EU citizens' data to the US under the Safe Harbor agreement.
Who was affected
EU citizens whose data was transferred by Facebook Ireland to the US.
What the authority found
The Court raised concerns about the adequacy of US data protection under the Safe Harbor agreement, leading to its invalidation.
Why this matters
This ruling was a landmark moment in data protection law, emphasizing the need for robust data protection measures in international data transfers. It forced companies to reconsider their data transfer mechanisms and contributed to the creation of new data protection frameworks.
Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. Some of Mr. Schrems personal data had been transferred by Facebook Ireland to its servers belonging to Facebook Inc., located in the US. Personal data transferred by undertakings such as Facebook Ireland to their parent company established in the US can be accessed by the NSA and other US security agencies in the course of a mass and indiscriminate surveillance. EU citizens have no effective rights to be heard on question of surveillance and interception of their data by the NSA and other US security agencies. The Commission had declared data transfers to the US legal under Article 25(6) of the Data Protection Directive 95/46 (Directive 95/46) when complying with safe-harbor regime by Decision 2000/520 (the Adequacy Decision), finding the US's protection of personal data adequate in Article 1 of the decision, if the recipients adhered to so called safe harbor privacy principles. These included derogations from data protection principles for US national interests. In Article 3 of the decision the Commission heightened the threshold for DPAs to take action within the scope of Article Article 25 of Directive 95/46. In 2013, Mr. Schrems complained to the Irish Data Protection Commissioner (DPC) seeking to prohibit these transfers, claiming that the US did not have an adequate level of protection. When this complaint was rejected, he brought an action against the decision before the Irish High Court, which in turn referred a number of questions to the CJEU, asking in essence whether Article 25(6) of Directive 95/46, read in the light of Articles 7, 8 and 47 CFR, must be interpreted to mean that an Adequacy Decision prevents a DPA from examining the claim of a data subject regarding transfer of personal data to that third country when it contends that the law and practices in force in the third country do not ensure an adequate level of protection. The AG opined, that the derogations provi
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for Maximilian Schrems in IE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Maximilian Schrems - Ireland (2015). Retrieved from cookiefines.eu
Last updated: