What Schrems II Invalidated, and What Replaced It

What was Schrems II?

The Court of Justice of the European Union decided Schrems II, case C-311/18, on 16 July 2020, and in one judgment it invalidated the EU-US Privacy Shield while keeping standard contractual clauses, or SCCs, valid on stricter terms. The Grand Chamber ruled on a reference from the Irish High Court in proceedings between the Data Protection Commissioner and Facebook Ireland Ltd and Maximillian Schrems, "concerning a complaint brought by Mr Schrems concerning the transfer of his personal data by Facebook Ireland to Facebook Inc. in the United States." Its case-law identifier is ECLI:EU:C:2020:559.

The "II" marks it as the second Schrems case. In the first, decided on 6 October 2015 as case C-362/14, the court had declared invalid Commission Decision 2000/520/EC of 26 July 2000, the Safe Harbour decision. Privacy Shield was the replacement for Safe Harbour, and Schrems II struck the replacement down too.

Date	Event	Source
26 July 2000	Commission adopts Safe Harbour, Decision 2000/520/EC	Schrems II, paragraph 42
5 February 2010	Commission adopts SCC Decision 2010/87/EU	Schrems II, operative point 4
6 October 2015	Court invalidates Safe Harbour in Schrems I, C-362/14	Schrems II, paragraph 53
12 July 2016	Commission adopts Privacy Shield, Implementing Decision (EU) 2016/1250	Schrems II, operative point 5
9 May 2018	Case C-311/18 lodged at the Court of Justice	Curia case record
16 July 2020	Schrems II judgment: Privacy Shield invalid, SCC decision valid	ECLI:EU:C:2020:559
4 June 2021	Commission adopts new SCCs, Implementing Decision (EU) 2021/914	EUR-Lex
18 June 2021	EDPB adopts final Recommendations 01/2020 on supplementary measures	EDPB
27 September 2021	Old SCC decisions repealed	Decision 2021/914, Article 4
7 October 2022	United States adopts Executive Order 14086	Decision 2023/1795, recital 6
27 December 2022	Contracts on the old SCCs stop counting as appropriate safeguards	Decision 2021/914, Article 4(4)
10 July 2023	Commission adopts the EU-US Data Privacy Framework adequacy decision, (EU) 2023/1795	EUR-Lex
3 September 2025	General Court dismisses Latombe v Commission, T-553/23	ECLI:EU:T:2025:831
31 October 2025	Latombe appeals to the Court of Justice, C-703/25 P	Curia case record, pending

What did the court rule in Schrems II?

The court gave five rulings in the operative part of the judgment: one on scope, two on how SCC transfers work, one upholding the SCC decision and one striking down Privacy Shield. The first confirms that the GDPR applies to a commercial transfer even if the destination country's security agencies can access the data. Points 2 to 5 read, from the English text on EUR-Lex:

2. Article 46(1) and Article 46(2)(c) of Regulation 2016/679 must be interpreted as meaning that the appropriate safeguards, enforceable rights and effective legal remedies required by those provisions must ensure that data subjects whose personal data are transferred to a third country pursuant to standard data protection clauses are afforded a level of protection essentially equivalent to that guaranteed within the European Union by that regulation, read in the light of the Charter of Fundamental Rights of the European Union. To that end, the assessment of the level of protection afforded in the context of such a transfer must, in particular, take into consideration both the contractual clauses agreed between the controller or processor established in the European Union and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the personal data transferred, the relevant aspects of the legal system of that third country, in particular those set out, in a non-exhaustive manner, in Article 45(2) of that regulation.

3. Article 58(2)(f) and (j) of Regulation 2016/679 must be interpreted as meaning that, unless there is a valid European Commission adequacy decision, the competent supervisory authority is required to suspend or prohibit a transfer of data to a third country pursuant to standard data protection clauses adopted by the Commission, if, in the view of that supervisory authority and in the light of all the circumstances of that transfer, those clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law, in particular by Articles 45 and 46 of that regulation and by the Charter of Fundamental Rights, cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.

4. Examination of Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EU of the European Parliament and of the Council, as amended by Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights has disclosed nothing to affect the validity of that decision.

5. Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield is invalid.

Point 5 is the headline. Point 4 kept the SCC decision valid, and points 2 and 3 attach conditions to every transfer made under it: each one now needs its own check of the destination country's law.

Why did the court invalidate Privacy Shield?

The court invalidated Privacy Shield on two grounds: US surveillance law was not proportionate, and EU residents had no effective remedy before an independent body. On the first ground, paragraph 184 found that "neither Section 702 of the FISA, nor E.O. 12333, read in conjunction with PPD-28, correlates to the minimum safeguards resulting, under EU law, from the principle of proportionality, with the consequence that the surveillance programmes based on those provisions cannot be regarded as limited to what is strictly necessary."

On the second ground, the Privacy Shield decision relied on an ombudsperson who, as paragraph 195 notes, was appointed by the Secretary of State and was "an integral part of the US State Department". Paragraph 197 held that the mechanism "does not provide any cause of action before a body which offers the persons whose data is transferred to the United States guarantees essentially equivalent to those required by Article 47 of the Charter." Article 47 is the Charter's right to an effective remedy and a fair trial.

The court gave no grace period. Paragraph 202 declined to keep the decision in force temporarily because Article 49 GDPR, which lists derogations such as explicit consent to a transfer, meant that striking the decision down was "not liable to create such a legal vacuum." Privacy Shield stopped being a valid transfer basis on the day of the judgment.

What happened to standard contractual clauses after Schrems II?

Standard contractual clauses stayed valid, but the exporter became responsible for checking whether the destination country lets the importer honour them. Paragraph 134 puts the duty on the company sending the data:

It is therefore, above all, for that controller or processor to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data, whether the law of the third country of destination ensures adequate protection, under EU law, of personal data transferred pursuant to standard data protection clauses, by providing, where necessary, additional safeguards to those offered by those clauses.

Paragraph 135 states the consequence when that check fails: the exporter or, failing that, the supervisory authority is "required to suspend or end the transfer of personal data to the third country concerned."

Two documents followed. The EDPB adopted the final version of its Recommendations 01/2020 on measures that supplement transfer tools on 18 June 2021. The Commission adopted a new set of SCCs in Implementing Decision (EU) 2021/914 on 4 June 2021. Clause 14 of the new clauses builds the Schrems II check into the contract. In Clause 14(a) the parties "warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses." Clause 14(d) adds: "The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request." That documented assessment is what practitioners call a transfer impact assessment.

Article 4 of Decision 2021/914 repealed the 2010 decision "with effect from 27 September 2021" and let older contracts count as appropriate safeguards only "until 27 December 2022", provided the processing stayed unchanged.

The Schrems II check for SCC transfers

1

Check the destination law. Verify whether the third country's rules let the importer honor the clauses, per paragraph 134.

2

Add safeguards if needed. Layer on supplementary measures from the EDPB's Recommendations 01/2020.

3

Document the assessment. Record it under Clause 14(d) and produce it to the supervisory authority on request.

4

Suspend if protection fails. Paragraph 135 requires the exporter, or the authority, to end the transfer.

What replaced Privacy Shield?

The EU-US Data Privacy Framework replaced Privacy Shield, through Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. It rests on a change in US law: recital 6 of the decision records that "the United States on 7 October 2022 adopted Executive Order 14086 'Enhancing Safeguards for US Signals Intelligence Activities'", complemented by an Attorney General regulation creating a Data Protection Review Court. Those two instruments answer the two grounds in paragraphs 184 and 197. Article 1 of the decision reads:

For the purpose of Article 45 of Regulation (EU) 2016/679, the United States ensures an adequate level of protection for personal data transferred from the Union to organisations in the United States that are included in the 'Data Privacy Framework List', maintained and made publicly available by the U.S. Department of Commerce, in accordance with Section I.3 of Annex I.

The scope is narrower than "the United States". Adequacy covers only organisations on that list. A transfer to a US company that has not self-certified still needs an Article 46 tool, and Article 46(1) GDPR allows such transfers "only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available." For those transfers, the Schrems II assessment still applies. Article 3 of the decision requires the Commission to monitor the framework continuously and allows it to "suspend, amend or repeal this Decision, or limit its scope" under Article 45(5) GDPR.

Is the Data Privacy Framework settled law?

No. The Data Privacy Framework has survived its first court challenge, and that ruling is under appeal. Philippe Latombe, an applicant from Nantes, France, filed case T-553/23 at the General Court on 6 September 2023. The President of the General Court refused interim suspension of the decision on 12 October 2023. On 3 September 2025 the Tenth Chamber, in extended composition, ruled: "Dismisses the action". Ireland and the United States intervened on the Commission's side. Latombe brought an appeal on 31 October 2025, case C-703/25 P, and the Court of Justice lists it as pending.

Until the Court of Justice rules, a company can rely on the 2023 decision for transfers to listed organisations, because an adequacy decision stays in force until it is repealed or annulled. The risk is the one Privacy Shield users met on 16 July 2020: an annulment takes effect on the day of judgment, and paragraph 202 of Schrems II shows the court will not grant a transition period when Article 49 is available.

What does Schrems II mean for website analytics?

Schrems II means every analytics or tag vendor that sends EU visitor data to the United States needs a valid transfer basis for that flow, checked per vendor. How the judgment played out for Google Analytics is traced in the analysis of whether GA4 is GDPR compliant. Check whether the vendor's US entity appears on the Data Privacy Framework list. If it does not, look for SCCs and a documented Clause 14 assessment. The transfer basis is a separate question from the legal basis for processing: an adequacy decision does not make processing lawful, and neither does legitimate interest under the GDPR make a transfer lawful. Hosting location alone does not settle the transfer question either, a point developed in the piece on digital sovereignty and data location. For a shortlist of tools assessed on these grounds, see the comparison of GDPR-focused Google Analytics alternatives.

Frequently asked questions

What is the case number and date of Schrems II?

Schrems II is case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems. The Grand Chamber of the Court of Justice delivered the judgment on 16 July 2020, with the identifier ECLI:EU:C:2020:559. The case was lodged on 9 May 2018.

Did Schrems II ban data transfers to the United States?

No. It invalidated one transfer basis, the Privacy Shield adequacy decision, and upheld the SCC decision. Transfers under SCCs remained possible if the exporter verified that US law allowed the importer to comply, adding safeguards where needed, and suspended the transfer where it could not.

What is the difference between Schrems I and Schrems II?

Schrems I, case C-362/14 decided on 6 October 2015, invalidated the Safe Harbour decision of 26 July 2000. Schrems II, decided on 16 July 2020, invalidated its successor, Privacy Shield, and set conditions for standard contractual clauses. Both began with complaints by Maximillian Schrems about Facebook transfers to the United States.

Are the old 2010 standard contractual clauses still valid?

No. Implementing Decision (EU) 2021/914 repealed Decision 2010/87/EU with effect from 27 September 2021. Contracts signed on the old clauses before that date counted as appropriate safeguards only until 27 December 2022, and only if the processing stayed unchanged.

Does the Data Privacy Framework cover every US company?

No. Article 1 of Decision 2023/1795 limits adequacy to organisations "included in the 'Data Privacy Framework List'" maintained by the US Department of Commerce. A US recipient outside that list needs an Article 46 safeguard such as SCCs.

Could the Data Privacy Framework be struck down like Privacy Shield?

Yes, if the Court of Justice annuls it on appeal. The General Court dismissed the Latombe challenge on 3 September 2025, and the appeal, case C-703/25 P, is pending. The Commission can also suspend, amend or repeal the decision under Article 45(5) GDPR if US protection falls short.

What is a transfer impact assessment?

A transfer impact assessment is the documented check that Clause 14 of the 2021 SCCs requires before a transfer goes ahead. The exporter records whether the destination country's laws let the importer honor the clauses, then makes that record available to the supervisory authority on request under Clause 14(d). The name comes from practitioners, not from the judgment itself, though paragraph 134 of Schrems II created the underlying obligation.

Who filed the complaint behind Schrems II?

Maximillian Schrems complained that Facebook Ireland's transfer of his personal data to Facebook Inc. in the United States exposed him to US surveillance without an effective remedy. The Irish High Court referred his case to the Court of Justice, which decided it as C-311/18 between the Data Protection Commissioner, Facebook Ireland Ltd, and Schrems. He had already brought the complaint that led to Schrems I in 2015.

What is Executive Order 14086?

Executive Order 14086, "Enhancing Safeguards for US Signals Intelligence Activities", is the US measure the Commission cites in recital 6 of Decision 2023/1795 as the basis for the Data Privacy Framework. The United States adopted it on 7 October 2022, alongside an Attorney General regulation that created the Data Protection Review Court. Together the two instruments are meant to answer the proportionality and remedy problems the court found in Schrems II paragraphs 184 and 197.

What is the Data Protection Review Court?

The Data Protection Review Court is the body a US Attorney General regulation created alongside Executive Order 14086, to give EU data subjects a way to challenge US signals intelligence access to their data. It is meant to answer the remedy problem from Schrems II paragraph 197, where the Privacy Shield ombudsperson was found not to offer guarantees equivalent to Article 47 of the Charter. The Commission relies on both instruments as grounds for the 2023 adequacy decision.