Schrems II

What is Schrems II?

Schrems II is the 16 July 2020 ruling of the EU Court of Justice in Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems. It struck down Privacy Shield, a framework many US companies relied on to receive personal data from the EU. It kept standard contractual clauses (SCCs) valid, but changed how they must be used.

The case is named after Maximillian Schrems, an Austrian Facebook user whose complaint to the Irish regulator started it. His earlier case, Schrems I, ended in 2015 with the court striking down Safe Harbour, the framework before Privacy Shield.

What the court decided

• Privacy Shield was invalid. US surveillance programs were not limited to what is strictly necessary, and EU individuals had no actionable rights before a court. The Privacy Shield Ombudsperson was not independent enough and could not bind the intelligence services.
• SCCs stayed valid. Data sent under them must get protection "essentially equivalent" to the EU's. That depends on both the contract and the destination country's laws on public authorities' access to the data.
• Check before you send. The clauses oblige the exporter and the importer to verify, before any transfer, that this level of protection is respected, and the importer must say if it cannot comply.
• Regulators must act. Where there is no adequacy decision and the clauses cannot be honored, data protection authorities must suspend or prohibit the transfer if the exporter has not already stopped it.

What came after

• The Commission adopted new SCCs on 4 June 2021, replacing the three older sets.
• The EDPB's Recommendations 01/2020, final on 18 June 2021, set six steps: know your transfers, identify the transfer tool, assess the destination's law and practice, add supplementary measures where needed, take any procedural steps, and re-evaluate. That assessment became the transfer impact assessment.
• The US adopted Executive Order 14086 on 7 October 2022 to strengthen safeguards on intelligence activities, backed by a new Data Protection Review Court.
• In May 2023, Ireland's regulator fined Meta 1.2 billion euros for continuing US transfers after the ruling and ordered it to suspend them.
• On 10 July 2023, the Commission adopted the EU-US Data Privacy Framework (DPF), a new adequacy decision for certified US companies.
• On 3 September 2025, the EU General Court dismissed a challenge to the DPF. It held that Schrems II requires at least judicial review after the fact for bulk collection, not prior approval by an independent body. The challenger appealed to the Court of Justice on 31 October 2025 (Case C-703/25 P); as of October 2026 the appeal was pending.

What it looks like in a vendor's terms

Since Schrems II, many DPAs include promises about government data requests. A typical clause reads like this:

If Vendor receives a request from a public authority for Customer Personal Data, Vendor will notify Customer unless legally prohibited, will challenge the request where it has reasonable grounds to consider it unlawful, and will disclose only the minimum data required. Vendor has assessed the laws of the countries where it processes Customer Personal Data and has no reason to believe they prevent it from meeting its obligations under the Standard Contractual Clauses.

• "Unless legally prohibited": the promise has an exception built in, so you may not hear about every request.
• "Will challenge ... reasonable grounds": a commitment to push back, not a promise to refuse.
• "Has assessed the laws": the vendor's own transfer impact assessment. Ask for a summary.

Why it matters to you

Many of your vendors send data to the US or use US subprocessors. Today a vendor certified under the DPF can receive EU data without SCCs. But the DPF rests on US commitments, and the General Court noted the Commission can suspend, amend or repeal it if US law changes. If that happens, transfers fall back to SCCs and the checks Schrems II requires. The same checks already apply to any other country without an adequacy decision.

What to check

• Transfer tool: For each vendor, whether it relies on the DPF, SCCs or something else.
• Fallback: The DPA switches to SCCs if the DPF falls.
• Assessment: The vendor offers a transfer impact assessment or a summary of the laws it checked.
• Government access: Notice, challenge and data-minimization promises, and whether the vendor publishes a transparency report.
• Subprocessors: Where they are. A new country means a new assessment.

How Venpo helps

Venpo watches your vendors' DPAs, privacy policies and subprocessor lists and emails a plain-English alert when one changes, such as a vendor dropping SCCs as a fallback, rewriting its government-request promises or adding a subprocessor in a new country. The Fine Print Scan answers, per vendor, whether your data goes to China or other restricted countries.