Maximillian Schrems v Data Protection Commissioner.
Jurisdiction | European Union |
ECLI | ECLI:EU:C:2015:650 |
Docket Number | C-362/14 |
Celex Number | 62014CJ0362 |
Court | Court of Justice (European Union) |
Procedure Type | Reference for a preliminary ruling |
Date | 06 October 2015 |
JUDGMENT OF THE COURT (Grand Chamber)
6 October 2015 ( * )
‛Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of such data — Charter of Fundamental Rights of the European Union — Articles 7, 8 and 47 — Directive 95/46/EC — Articles 25 and 28 — Transfer of personal data to third countries — Decision 2000/520/EC — Transfer of personal data to the United States — Inadequate level of protection — Validity — Complaint by an individual whose data has been transferred from the European Union to the United States — Powers of the national supervisory authorities’
In Case C‑362/14,
REQUEST for a preliminary ruling under Article 267 TFEU from the High Court (Ireland), made by decision of 17 July 2014, received at the Court on 25 July 2014, in the proceedings
Maximillian Schrems
v
Data Protection Commissioner,
joined party:
Digital Rights Ireland Ltd,
THE COURT (Grand Chamber),
composed of V. Skouris, President, K. Lenaerts, Vice-President, A. Tizzano, R. Silva de Lapuerta, T. von Danwitz (Rapporteur), S. Rodin and K. Jürimäe, Presidents of Chambers, A. Rosas, E. Juhász, A. Borg Barthet, J. Malenovský, D. Šváby, M. Berger, F. Biltgen and C. Lycourgos, Judges,
Advocate General: Y. Bot,
Registrar: L. Hewlett, Principal Administrator,
having regard to the written procedure and further to the hearing on 24 March 2015,
after considering the observations submitted on behalf of:
— |
Mr Schrems, by N. Travers, Senior Counsel, P. O’Shea, Barrister-at-Law, G. Rudden, Solicitor, and H. Hofmann, Rechtsanwalt, |
— |
the Data Protection Commissioner, by P. McDermott, Barrister-at-Law, S. More O’Ferrall and D. Young, Solicitors, |
— |
Digital Rights Ireland Ltd, by F. Crehan, Barrister-at-Law, and S. McGarr and E. McGarr, Solicitors, |
— |
Ireland, by A. Joyce, B. Counihan and E. Creedon, acting as Agents, and D. Fennelly, Barrister-at-Law, |
— |
the Belgian Government, by J.-C. Halleux and C. Pochet, acting as Agents, |
— |
the Czech Government, by M. Smolek and J. Vláčil, acting as Agents, |
— |
the Italian Government, by G. Palmieri, acting as Agent, and P. Gentili, avvocato dello Stato, |
— |
the Austrian Government, by G. Hesse and G. Kunnert, acting as Agents, |
— |
the Polish Government, by M. Kamejsza, M. Pawlicka and B. Majczyna, acting as Agents, |
— |
the Slovenian Government, by A. Grum and V. Klemenc, acting as Agents, |
— |
the United Kingdom Government, by L. Christie and J. Beeko, acting as Agents, and J. Holmes, Barrister, |
— |
the European Parliament, by D. Moore, A. Caiola and M. Pencheva, acting as Agents, |
— |
the European Commission, by B. Schima, B. Martenczuk, B. Smulders and J. Vondung, acting as Agents, |
— |
the European Data Protection Supervisor (EDPS), by C. Docksey, A. Buchta and V. Pérez Asinari, acting as Agents, |
after hearing the Opinion of the Advocate General at the sitting on 23 September 2015,
gives the following
Judgment
1 |
This request for a preliminary ruling relates to the interpretation, in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’), of Articles 25(6) and 28 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), as amended by Regulation (EC) No 1882/2003 of the European Parliament and of the Council of 29 September 2003 (OJ 2003 L 284, p. 1) (‘Directive 95/46’), and, in essence, to the validity of Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46 on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (OJ 2000 L 215, p. 7). |
2 |
The request has been made in proceedings between Mr Schrems and the Data Protection Commissioner (‘the Commissioner’) concerning the latter’s refusal to investigate a complaint made by Mr Schrems regarding the fact that Facebook Ireland Ltd (‘Facebook Ireland’) transfers the personal data of its users to the United States of America and keeps it on servers located in that country. |
Legal context
3 |
Recitals 2, 10, 56, 57, 60, 62 and 63 in the preamble to Directive 95/46 are worded as follows:
…
…
…
…
|
4 |
Articles 1, 2, 25, 26, 28 and 31 of Directive 95/46 provide: ‘Article 1 Object of the Directive 1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. ... Article 2 Definitions For the purposes of this Directive:
...
... Article 25 Principles 1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection. 2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country. 3. The Member States and the Commission shall inform each other of cases where they consider that a third country does not ensure an adequate level of protection within the meaning of paragraph 2. 4. Where the Commission finds, under the procedure provided for in Article 31(2), that a third country does not ensure an... |
To continue reading
Request your trial-
Gräfendorfer Geflügel- und Tiefkühlfeinkost Produktions GmbH and F. Reyher Nchfg. GmbH & Co. KG vertr. d. d. Komplementärin Verwaltungsgesellschaft F. Reyher Nchfg. mbH v Hauptzollamt Hamburg.
...su invalidez (sentencias de 22 de octubre de 1987, Foto-Frost, 314/85, EU:C:1987:452, apartados 15 a 20, y de 6 de octubre de 2015, Schrems, C‑362/14, EU:C:2015:650, apartado 62), sino también por un órgano jurisdiccional nacional, tanto si este debe extraer las consecuencias de una declara......
-
Opinion of Advocate General Bobek delivered on 15 April 2021.
...to 20); judgments of 22 June 2010, Melki and Abdeli (C‑188/10 and C‑189/10, EU:C:2010:363, paragraphs 54 to 56); of 6 October 2015, Schrems (C‑362/14, EU:C:2015:650, paragraph 62); and of 28 March 2017, Rosneft (C‑72/15, EU:C:2017:236, paragraph 71 See my Opinion in Consorzio Italian Manage......
-
Opinion of Advocate General Saugmandsgaard Øe delivered on 22 February 2018.
...EU:C:2014:5); and of 2 March 2017, Commission v Greece (C‑160/16, not published, EU:C:2017:161). 8 Judgment of 6 October 2015, Schrems (C‑362/14, EU:C:2015:650, paragraph 52 and the case-law 9 After setting aside the judgment of the General Court of 11 November 2015, Dyson v Commission (T‑5......
-
Liga van Moskeeën en Islamitische Organisaties Provincie Antwerpen, VZW and Others v Vlaams Gewest.
...compatibility with, in particular, the Treaties, general principles of law and fundamental rights (judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 60 and the case-law 39 First of all, as regards the right to freedom of religion referred to by the question, the nation......
-
Gräfendorfer Geflügel- und Tiefkühlfeinkost Produktions GmbH and F. Reyher Nchfg. GmbH & Co. KG vertr. d. d. Komplementärin Verwaltungsgesellschaft F. Reyher Nchfg. mbH v Hauptzollamt Hamburg.
...su invalidez (sentencias de 22 de octubre de 1987, Foto-Frost, 314/85, EU:C:1987:452, apartados 15 a 20, y de 6 de octubre de 2015, Schrems, C‑362/14, EU:C:2015:650, apartado 62), sino también por un órgano jurisdiccional nacional, tanto si este debe extraer las consecuencias de una declara......
-
Opinion of Advocate General Saugmandsgaard Øe delivered on 22 February 2018.
...EU:C:2014:5); and of 2 March 2017, Commission v Greece (C‑160/16, not published, EU:C:2017:161). 8 Judgment of 6 October 2015, Schrems (C‑362/14, EU:C:2015:650, paragraph 52 and the case-law 9 After setting aside the judgment of the General Court of 11 November 2015, Dyson v Commission (T‑5......
-
Liga van Moskeeën en Islamitische Organisaties Provincie Antwerpen, VZW and Others v Vlaams Gewest.
...compatibility with, in particular, the Treaties, general principles of law and fundamental rights (judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 60 and the case-law 39 First of all, as regards the right to freedom of religion referred to by the question, the nation......
-
Opinion of Advocate General Tanchev delivered on 11 April 2018.
...in Commission v AssiDomän Kraft Products and Others, C‑310/97 P, EU:C:1999:36, point 2. 80 See e.g. judgments of 6 October 2014, Schrems, C‑362/14, EU:C:2015:650, paragraph 95, and of 16 May 2017, Berlioz Investment Fund, C‑682/15, EU:C:2017:373, paragraphs 44 to 59; see also e.g. Opinions ......
-
Data Transfer Mechanisms To Be Reviewed By CJEU After Irish Supreme Court Dismisses Facebook Appeal
...Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, and Uruguay. [3] Case C-362/14 Maximillian Schrems v Data Protection Commissioner, 6 October 2015. Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of ......
-
Chapter 19: Glossary – Unlocking the EU General Data Protection Regulation
...subsequently held to be invalid by the CJEU in Schrems. Schrems means the decision of the CJEU in Schrems v Data Protection Commissioner (Case C-362/14). Sensitive Personal Data means personal data, revealing race or ethnicity, political opinions, religion or beliefs, trade- union membershi......
-
International Data Transfers Under The GDPR: From Schrems To The New Standard Contractual Clauses And The EDPB Recommendations
...with the EU level of protection of personal data Version 2.0, adopted on 18 June 2021, also discussed below. The Schrems Rulings Case C-362/14 (Schrems I) challenged the Irish DPC's refusal to investigate a complaint by an Austrian privacy advocate, Max Schrems, asking the DPC to suspend da......
-
Court Of Justice Of The European Union Holds That 'Safe Harbor' Decision Of European Commission Is Invalid
...CJEU, transfers, personal data, Safe Harbor In its judgment of October 6, 2015 (Case C-362/14) the Court of Justice of the European Union ("CJEU") held that transfers of personal data of European citizens to the United States made under the so-called Safe Harbor scheme are subject to signif......
-
La consolidación de la Carta de Derechos Fundamentales de la Unión Europea. Su aplicación en el periodo 2018-2020
...25.2 de la Directiva 95/46/CE . Sin embargo, el Tribunal de Justicia no compartió este parecer y en su Sentencia de 6 de octubre de 2015, C-362/14 ( Schrems I ), invalidó la citada Decisión. Pues bien, en 2016 la Comisión aprobó una nueva Decisión —2016/1250 (conocida como Privacy Shield )—......
-
La Carta de Derechos Fundamentales de la Unión Europea. Once años de jurisprudencia
...as. C-311/18 (cfr., entre otros, GARCÍA-PERROTE y GARCÍA-MICÓ, 2020). Recuérdese que ya, mediante sentencia de 6 de octubre de 2015, as. C-362/14, se había decretado la invalidez de la Decisión 2000/520, sobre el «puerto seguro» (cfr., entre otros, URÍA GAVILÁN, 2016). 30 No se declara invá......
-
The eu Charter of Fundamental Rights in english law: flickering lights in the twilight of membership
...Tele2 Sverige AB v. Postoch telestyrelsen , Joined cases 203 & 698/15, ECLI:EU:C:2016:970, Schrems v. Data Protection Commissioner , case C-362/14, ECLI:EU:C:2015:650. 82 Cresco Investigation , case C-193/17, EU:C:2019:43. 83 Stadt Wuppertal v. Bauer , Joined cases C-569/16 and C-570/16, EC......
-
Fundamental Rights and Legal Wrongs: The Two Sides of the Same EU Coin
...C-138/01 and C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989;Case C-131/12 Google Spain, EU:C:2014:317, paras 80–81; Case C-362/14 Schrems, EU:C:2015:650,para 94.62Case C-44/79 Hauer, EU: C: 1979: 290, para 23; Joined Cases C-20/00 and C-64/00 Booker Aquaculture& Hydro Seafo......
-
Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document C(2016) 4176) (Text with EEA relevance)
...2016. (3) Sentenza della Corte di giustizia nella causa Maximillian Schrems contro Data Protection Commissioner («Schrems»), C-362/14, ECLI:EU:C:2015:650, punto (4) Sentenza Rijkeboer, C-553/07, ECLI:EU:C:2009:293, punto 47; sentenza Digital Rights Ireland e a., cause riunite C-293/12 e C-5......
-
Commission Implementing Decision (EU) 2016/2295 of 16 December 2016 amending Decisions 2000/518/EC, 2002/2/EC, 2003/490/EC, 2003/821/EC, 2004/411/EC, 2008/393/EC, 2010/146/EU, 2010/625/EU, 2011/61/EU and Implementing Decisions 2012/484/EU, 2013/65/EU on the adequate protection of personal data by certain countries, pursuant to Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council (notified under document C(2016) 8353) (Text with EEA relevance )
...Fait à Bruxelles, le 16 décembre 2016. Par la Commission Věra JOUROVÁ Membre de la Commission (1) JO L 281 du 23.11.1995, p. 31. (2) ECLI:EU:C:2015:650. (3) Décision 2000/520/CE de la Commission du 26 juillet 2000 conformément à la directive 95/46/CE du Parlement européen et du Conseil rela......
-
Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses for the transfer of personal data to third countries and to processors established in such countries, under Directive 95/46/EC of the European Parliament and of the Council (notified under document C(2016) 8471) (Text with EEA relevance )
...Fait à Bruxelles, le 16 décembre 2016. Par la Commission Věra JOUROVÁ Membre de la Commission (1) JO L 281 du 23.11.1995, p. 31. (2) ECLI:EU:C:2015:650. (3) Décision 2000/520/CE de la Commission du 26 juillet 2000 conformément à la directive 95/46/CE du Parlement européen et du Conseil rela......
-
Commission Implementing Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information (Text with EEA relevance)
...de la Commission (1) JO L 119 du 4.5.2016, p. 1. (2) Affaire C-362/14, Maximillian Schrems/Data Protection Commissioner («Schrems»), ECLI:EU:C:2015:650, point (3) Arrêt Schrems, point 74. (4) Voir la communication de la Commission au Parlement européen et au Conseil intitulée «Échange et pr......