Sofia Ranchordas, Eleni Kosta, Irene Kamara
Maria Tzanou - Senior Lecturer, School of Law, University of Sheffield, Plixavra Vogiatzoglou - Doctoral researcher, KU Leuven Centre for IT & IP Law (CiTiP) – imec
Laura Drechsler - Research fellow at the Centre for IT & IP Law (CiTiP), KU Leuven-imec/Lecturer, Open Universiteit, Heerlen
Eleni Kosta - Full Professor of Technology Law and Human Rights, Tilburg Institute for Law, Technology (TILT), Irene Kamara - Assistant Professor Cybercrime and Human Rights, Tilburg Institute for Law, Technology (TILT)
Janvier Parewyck - Attorney-at-law at Timelex and member of the Brussels Bar
Mariolina Eliantonio - Professor of European and Comparative Administrative Law (Maastricht University) and General Editor of the Review of European Administrative Law
In its Schrems II judgment, the Grand Chamber of the Court ruled that the United States law and practices, notably bulk-interception programmes, were not providing a level of protection of personal data essentially equivalent to the protection conferred by the EU Charter of Fundamental Rights and, therefore, invalidated the Privacy Shield for violating Articles 7 and 8 of the Charter. Since, in addition, there is no effective remedy available to data subjects protected by the GDPR, the Court held that the Privacy Shield also violated Article 47 of the Charter. The Court, nevertheless, left the standard data protection clauses as one of the transfer tools available to data exporters, with the understanding that it is up to the data exporter to implement the additional safeguards necessary to compensate for any shortcomings in the third country and achieve an essentially equivalent level of protection. While the judgment provides, to some extent, clear guidance on the application of EU law and maps out a coherent regime as to how data can be transferred, this article reflects on some aspects that remain problematic in practice, both for data exporters in general and for the original complainant in the Schrems litigation in particular. The ‘risk-based approach’ and its recognition are discussed, revealing that ultimately the law, and the Court's judgment, do not seem to allow for certainty in this matter and require the stakeholders to take a position in their respective situations, choosing between a strict or stretched interpretation.
Om toegang te krijgen tot het gehele artikel heeft u een abonnement nodig. Meer informatie over de abonnementsvormen en prijzen kunt u hier vinden.Abonneren op dit tijdschrift