Maximillian Schrems v Data Protection Commissioner.
Jurisdiction | European Union |
Court | Court of Justice (European Union) |
Date | 06 October 2015 |
JUDGMENT OF THE COURT (Grand Chamber)
6 October 2015 ( * )
‛Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of such data — Charter of Fundamental Rights of the European Union — Articles 7, 8 and 47 — Directive 95/46/EC — Articles 25 and 28 — Transfer of personal data to third countries — Decision 2000/520/EC — Transfer of personal data to the United States — Inadequate level of protection — Validity — Complaint by an individual whose data has been transferred from the European Union to the United States — Powers of the national supervisory authorities’
In Case C‑362/14,
REQUEST for a preliminary ruling under Article 267 TFEU from the High Court (Ireland), made by decision of 17 July 2014, received at the Court on 25 July 2014, in the proceedings
Maximillian Schrems
v
Data Protection Commissioner,
joined party:
Digital Rights Ireland Ltd,
THE COURT (Grand Chamber),
composed of V. Skouris, President, K. Lenaerts, Vice-President, A. Tizzano, R. Silva de Lapuerta, T. von Danwitz (Rapporteur), S. Rodin and K. Jürimäe, Presidents of Chambers, A. Rosas, E. Juhász, A. Borg Barthet, J. Malenovský, D. Šváby, M. Berger, F. Biltgen and C. Lycourgos, Judges,
Advocate General: Y. Bot,
Registrar: L. Hewlett, Principal Administrator,
having regard to the written procedure and further to the hearing on 24 March 2015,
after considering the observations submitted on behalf of:
— |
Mr Schrems, by N. Travers, Senior Counsel, P. O’Shea, Barrister-at-Law, G. Rudden, Solicitor, and H. Hofmann, Rechtsanwalt, |
— |
the Data Protection Commissioner, by P. McDermott, Barrister-at-Law, S. More O’Ferrall and D. Young, Solicitors, |
— |
Digital Rights Ireland Ltd, by F. Crehan, Barrister-at-Law, and S. McGarr and E. McGarr, Solicitors, |
— |
Ireland, by A. Joyce, B. Counihan and E. Creedon, acting as Agents, and D. Fennelly, Barrister-at-Law, |
— |
the Belgian Government, by J.-C. Halleux and C. Pochet, acting as Agents, |
— |
the Czech Government, by M. Smolek and J. Vláčil, acting as Agents, |
— |
the Italian Government, by G. Palmieri, acting as Agent, and P. Gentili, avvocato dello Stato, |
— |
the Austrian Government, by G. Hesse and G. Kunnert, acting as Agents, |
— |
the Polish Government, by M. Kamejsza, M. Pawlicka and B. Majczyna, acting as Agents, |
— |
the Slovenian Government, by A. Grum and V. Klemenc, acting as Agents, |
— |
the United Kingdom Government, by L. Christie and J. Beeko, acting as Agents, and J. Holmes, Barrister, |
— |
the European Parliament, by D. Moore, A. Caiola and M. Pencheva, acting as Agents, |
— |
the European Commission, by B. Schima, B. Martenczuk, B. Smulders and J. Vondung, acting as Agents, |
— |
the European Data Protection Supervisor (EDPS), by C. Docksey, A. Buchta and V. Pérez Asinari, acting as Agents, |
after hearing the Opinion of the Advocate General at the sitting on 23 September 2015,
gives the following
Judgment
1 |
This request for a preliminary ruling relates to the interpretation, in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’), of Articles 25(6) and 28 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), as amended by Regulation (EC) No 1882/2003 of the European Parliament and of the Council of 29 September 2003 (OJ 2003 L 284, p. 1) (‘Directive 95/46’), and, in essence, to the validity of Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46 on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (OJ 2000 L 215, p. 7). |
2 |
The request has been made in proceedings between Mr Schrems and the Data Protection Commissioner (‘the Commissioner’) concerning the latter’s refusal to investigate a complaint made by Mr Schrems regarding the fact that Facebook Ireland Ltd (‘Facebook Ireland’) transfers the personal data of its users to the United States of America and keeps it on servers located in that country. |
Legal context
3 |
Recitals 2, 10, 56, 57, 60, 62 and 63 in the preamble to Directive 95/46 are worded as follows:
…
…
…
…
|
4 |
Articles 1, 2, 25, 26, 28 and 31 of Directive 95/46 provide: ‘Article 1 Object of the Directive 1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. ... Article 2 Definitions For the purposes of this Directive:
...
... Article 25 Principles 1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection. 2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country. 3. The Member States and the Commission shall inform each other of cases where they consider that a third country does not ensure an adequate level of protection within the meaning of paragraph 2. 4. Where the Commission finds, under the procedure provided for in Article 31(2), that a third country does not ensure an... |
To continue reading
Request your trial-
Conclusions de l'avocat général M. G. Pitruzzella, présentées le 5 mars 2020.
...arguments avancés par la requérante au principal étaient susceptibles d’être fondés. 24 Voir arrêt du 6 octobre 2015, Schrems (C‑362/14, EU:C:2015:650, point 67) ; voir, également, conclusions de l’avocat général Bot dans l’affaire Schrems (C‑362/14, EU:C:2015:627, points 121 à 25 Voir, en ......
-
Conclusiones del Abogado General Sr. P. Pikamäe, presentadas el 22 de enero de 2020.
...point 72). 25 Arrêts du 18 décembre 2014, Abdida (C‑562/13, EU:C:2014:2453, point 45), du 6 octobre 2015, Schrems (C‑362/14, EU:C:2015:650, point 95), et du 28 mars 2017, Rosneft (C‑72/15, EU:C:2017:236, point 26 Voir Calliess, C., in Calliess, C., et Ruffert, M. (éd.), EUV/AEUV, C. H. Beck......
-
Ministre de l'Agriculture et de l'Alimentation v Compagnie des pêches de Saint-Malo.
...8; de 11 de junio de 2009, Hans & Christophorus Oymanns, C‑300/07, EU:C:2009:358, apartados 46 y 47; de 6 de octubre de 2015, Schrems, C‑362/14, EU:C:2015:650, apartado 67, y de 16 de julio de 2020, Facebook Ireland y Schrems, C‑311/18, EU:C:2020:559, apartados 159 a 29 Pues bien, en el pre......
-
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH.
...the Charter of Fundamental Rights of the European Union and Article 16(2) TFEU (see, to that effect, judgment of 6 September 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 69 Furthermore, while under the second subparagraph of Article 28(6) of Directive 95/46 the supervisory authorities ......
-
Conclusions de l'avocat général M. G. Pitruzzella, présentées le 5 mars 2020.
...arguments avancés par la requérante au principal étaient susceptibles d’être fondés. 24 Voir arrêt du 6 octobre 2015, Schrems (C‑362/14, EU:C:2015:650, point 67) ; voir, également, conclusions de l’avocat général Bot dans l’affaire Schrems (C‑362/14, EU:C:2015:627, points 121 à 25 Voir, en ......
-
Conclusiones del Abogado General Sr. P. Pikamäe, presentadas el 22 de enero de 2020.
...point 72). 25 Arrêts du 18 décembre 2014, Abdida (C‑562/13, EU:C:2014:2453, point 45), du 6 octobre 2015, Schrems (C‑362/14, EU:C:2015:650, point 95), et du 28 mars 2017, Rosneft (C‑72/15, EU:C:2017:236, point 26 Voir Calliess, C., in Calliess, C., et Ruffert, M. (éd.), EUV/AEUV, C. H. Beck......
-
Ministre de l'Agriculture et de l'Alimentation v Compagnie des pêches de Saint-Malo.
...8; de 11 de junio de 2009, Hans & Christophorus Oymanns, C‑300/07, EU:C:2009:358, apartados 46 y 47; de 6 de octubre de 2015, Schrems, C‑362/14, EU:C:2015:650, apartado 67, y de 16 de julio de 2020, Facebook Ireland y Schrems, C‑311/18, EU:C:2020:559, apartados 159 a 29 Pues bien, en el pre......
-
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH.
...the Charter of Fundamental Rights of the European Union and Article 16(2) TFEU (see, to that effect, judgment of 6 September 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 69 Furthermore, while under the second subparagraph of Article 28(6) of Directive 95/46 the supervisory authorities ......
-
Data Transfer Mechanisms To Be Reviewed By CJEU After Irish Supreme Court Dismisses Facebook Appeal
...Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, and Uruguay. [3] Case C-362/14 Maximillian Schrems v Data Protection Commissioner, 6 October 2015. Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of ......
-
Chapter 19: Glossary – Unlocking the EU General Data Protection Regulation
...subsequently held to be invalid by the CJEU in Schrems. Schrems means the decision of the CJEU in Schrems v Data Protection Commissioner (Case C-362/14). Sensitive Personal Data means personal data, revealing race or ethnicity, political opinions, religion or beliefs, trade- union membershi......
-
International Data Transfers Under The GDPR: From Schrems To The New Standard Contractual Clauses And The EDPB Recommendations
...with the EU level of protection of personal data Version 2.0, adopted on 18 June 2021, also discussed below. The Schrems Rulings Case C-362/14 (Schrems I) challenged the Irish DPC's refusal to investigate a complaint by an Austrian privacy advocate, Max Schrems, asking the DPC to suspend da......
-
Court Of Justice Of The European Union Holds That 'Safe Harbor' Decision Of European Commission Is Invalid
...CJEU, transfers, personal data, Safe Harbor In its judgment of October 6, 2015 (Case C-362/14) the Court of Justice of the European Union ("CJEU") held that transfers of personal data of European citizens to the United States made under the so-called Safe Harbor scheme are subject to signif......
-
El régimen general de condicionalidad para la protección del presupuesto de la Unión Europea: ¿un mecanismo efectivo de garantía del estado de derecho en los estados miembros de la Unión Europea?
...TJUE (2015), Berlington Hungary y otros, C 98/14, EU:C:2015:386. Sentencia TJUE (2015), Maximillian Schrems/ Data Protection Commissioner, C-362/14, EU:C:2015:650. Sentencia TJUE (2016), Pál Aranyosi y Robert Căldăraru, C-404/15-C-659/15 PPU, EU:C:2016:198. Sentencia TJUE (2016), Ledra Adve......
-
Tutela judicial efectiva y medidas de ayuda a los estados en el marco de la UEM: jurisprudencia del TJUE y comparación con otros ámbitos de derecho de la Unión Europea
...47...», loc. cit. , pp. 745-746. 11 Sentencia de 6 de octubre de 2015, Maximilian Schrems y Data Protection Commissioner , C-362/14, ECLI:EU:C:2015:650, § 95. 32 SÍLVIA MORGADES GIL El abogado general Henrik Saugmandsgaard ØE señaló en sus conclusiones en el caso Asociación Sindical de Juec......
-
La consolidación de la Carta de Derechos Fundamentales de la Unión Europea. Su aplicación en el periodo 2018-2020
...25.2 de la Directiva 95/46/CE . Sin embargo, el Tribunal de Justicia no compartió este parecer y en su Sentencia de 6 de octubre de 2015, C-362/14 ( Schrems I ), invalidó la citada Decisión. Pues bien, en 2016 la Comisión aprobó una nueva Decisión —2016/1250 (conocida como Privacy Shield )—......
-
Fundamental Rights and Legal Wrongs: The Two Sides of the Same EU Coin
...C-138/01 and C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989;Case C-131/12 Google Spain, EU:C:2014:317, paras 80–81; Case C-362/14 Schrems, EU:C:2015:650,para 94.62Case C-44/79 Hauer, EU: C: 1979: 290, para 23; Joined Cases C-20/00 and C-64/00 Booker Aquaculture& Hydro Seafo......
-
Commission Implementing Decision (EU) 2016/2295 of 16 December 2016 amending Decisions 2000/518/EC, 2002/2/EC, 2003/490/EC, 2003/821/EC, 2004/411/EC, 2008/393/EC, 2010/146/EU, 2010/625/EU, 2011/61/EU and Implementing Decisions 2012/484/EU, 2013/65/EU on the adequate protection of personal data by certain countries, pursuant to Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council (notified under document C(2016) 8353) (Text with EEA relevance )
...Fait à Bruxelles, le 16 décembre 2016. Par la Commission Věra JOUROVÁ Membre de la Commission (1) JO L 281 du 23.11.1995, p. 31. (2) ECLI:EU:C:2015:650. (3) Décision 2000/520/CE de la Commission du 26 juillet 2000 conformément à la directive 95/46/CE du Parlement européen et du Conseil rela......
-
Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document C(2016) 4176) (Text with EEA relevance)
...2016. (3) Sentenza della Corte di giustizia nella causa Maximillian Schrems contro Data Protection Commissioner («Schrems»), C-362/14, ECLI:EU:C:2015:650, punto (4) Sentenza Rijkeboer, C-553/07, ECLI:EU:C:2009:293, punto 47; sentenza Digital Rights Ireland e a., cause riunite C-293/12 e C-5......
-
Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses for the transfer of personal data to third countries and to processors established in such countries, under Directive 95/46/EC of the European Parliament and of the Council (notified under document C(2016) 8471) (Text with EEA relevance )
...Fait à Bruxelles, le 16 décembre 2016. Par la Commission Věra JOUROVÁ Membre de la Commission (1) JO L 281 du 23.11.1995, p. 31. (2) ECLI:EU:C:2015:650. (3) Décision 2000/520/CE de la Commission du 26 juillet 2000 conformément à la directive 95/46/CE du Parlement européen et du Conseil rela......
-
Commission Implementing Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information (Text with EEA relevance)
...de la Commission (1) JO L 119 du 4.5.2016, p. 1. (2) Affaire C-362/14, Maximillian Schrems/Data Protection Commissioner («Schrems»), ECLI:EU:C:2015:650, point (3) Arrêt Schrems, point 74. (4) Voir la communication de la Commission au Parlement européen et au Conseil intitulée «Échange et pr......