Schrems II Referred to the Court of Justice of the European Union

The Tip of the Night for March 17, 2017, noted that Maximilian Schrems had filed an update to his initial complaint against Facebook contesting its Standard Contractual Clauses as a means to transfer data outside of the safe harbor scheme. On April 12, 2018, The Irish High Court referred this new case to the Court of Justice of the European Union. The CJEU is to provide answers to the following questions:

1. When data is transferred by an EU private company to a private company in a third country and may be processed in the third country for the purposes of national security, foreign affairs and law enforcement does EU law apply?

2. In such a case does EU law or the laws of member states apply?

3. In assessing the level of protection in a third country, should only its domestic laws and international treaties be considered, or should administrative and regulatory policies also be considered?

4. Does data transferred from the EU to the United States under the Standard Contractual Clauses decision violate individual rights?

5. Does US law provide for a judicial remedy for the breach of his or her EU data privacy rights? If so, do limitations on such a remedy for US national security exceed what is necessary in a democratic society?

6. What level of protection should be provided for personal data transferred via Standard Contractual Clauses?

7. If a data importer is required to make personal data available to security services, are the safeguards adequate?

8. If surveillance laws in the country of the data importer violate EU rights an the data protection authority use its powers to suspend data flows?

9. Does the Privacy Shield decision constitute a finding of general applicability binding on data protection authorities that the US provides an adequate level of protection?

10. Does the Privacy Shield ombudsman decision ensure that the US provides an adequate remedy to data subjects whose personal data is transferred to the United States under Standard Contractual Clauses?

11. Does the Standard Contractual Clauses decision violate Article 7 (respect for private and family file and communications); Article 8 (protection of personal data); and Article 47 (right for a judicial remedy)?