Schrems II
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Schrems II - CJEU case (C-311/18): a commercial data transfer is not removed from the GDPR merely because the data might later undergo processing for public security/national security in the third country.
In the CIPP/E body of knowledge, Schrems II comes up under Ch 12.5 - US: Privacy Shield to DPF; Ch 17.2.4 - Transfer mechanisms; Ch 5.3.3-5.3.6 - Other carve-outs and overlaps.
Schrems II in context
- It has shaped data protection through cases like [[Google Spain]], [[Schrems]] and [[Schrems II]]. (Court of Justice of the European Union (CJEU))
- [[Schrems II]] confirmed that a commercial transfer is not removed from the GDPR just because the data might later be processed for national security. (Law enforcement, EU institutions, ePrivacy and E-Commerce)
- The [[CJEU]] ==invalidated Privacy Shield on 16 July 2020== in [[Schrems II]], finding US surveillance law not essentially equivalent and the ombudsperson inadequate. (The United States - Privacy Shield, Schrems II and the Data Privacy Framework)
Where Schrems II is covered in the CIPP/E study notes
- Law enforcement, EU institutions, ePrivacy and E-Commerce
- The United States - Privacy Shield, Schrems II and the Data Privacy Framework
- Cloud: international data transfers
- Module 7 · Adequacy decisions & the Schrems/DPF saga
Related terms
- Article 2(2)(d)
- Law Enforcement Directive
- Competent authority
- ePrivacy Directive
- Privacy Shield
- Trans-Atlantic Data Privacy Framework
- SCCs
- Processor BCRs
- Article 49 derogation
- Adequacy decision
Test yourself on Schrems II
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.