International Data Transfers in the Recent CJEU Case Law -Invalidation of the Privacy Shield

• Jurisdiction: European Union
• Year: 2021
• Author: Paola Nebbia

Speaker

Paola (Paolisa) Nebbia is a legal secretary (référendaire) at the General Court of the European Union.

She previously headed the antitrust practice of Shearman & Sterling LLP’s Italian offices, as well as co-directing the firm’s data protection group in the EU. She has previously worked for the European Commission and for the Italian Competition Authority. Before that, she was a Reader in EU Law at the University of Leicester and a Law Fellow of St. Hilda’s College, University of Oxford. She is currently a visiting professor at the World Intellectual Property Organisation.

She has authored a number of books and articles in the field of competition law, media law, data protection and consumer law.

Topic

In her analysis, Paola Nebbia delves into the landmark ruling delivered by the Court of Justice of the European Union (CJEU) in the Schrems II case, a decision that reverberated throughout the realm of international data protection. This seminal judgment took place against the backdrop of the European Commission's Privacy Shield being invalidated, which cast a profound shadow over transatlantic data flows and the mechanisms governing them.

One of the pivotal aspects that Nebbia underscores in her examination is the critical role played by data controllers and processors in upholding the fundamental right to data protection for individuals. In the wake of the Schrems II ruling, these entities find themselves at the forefront of responsibility in ensuring that data subjects are afforded a level of protection that aligns with the high standards set forth by European Union (EU) data protection laws. They are tasked with evaluating the adequacy of data protection in the third countries to which data is being transferred, and if the CJEU deems that the level of protection is insufficient, they must implement additional safeguards.

Among these safeguards, Nebbia highlights the significance of standard contract clauses, often referred to as SCCs. These legally binding agreements, approved by the European Commission, serve as a contractual framework for data transfers between EU entities and counterparts in third countries. Nebbia elucidates how...