CJEU AG opinion: Standard Contractual Clauses are valid

The Court of Justice of the European Union (CJEU) Advocate General’s (AG) opinion, issued today, says that Standard Contractual Clauses remain valid for transfers to third countries. The Advocate General considers that "EU law applies to transfers of personal data to a third country where those transfers form part of a commercial activity, even though the transferred data might undergo processing, by the public authorities of that third country, for the purposes of national security".

Eduardo Ustaran, Co-Head of the global Privacy and Cybersecurity practice at Hogan Lovells, said: “This is a big victory for the European Commission so far, as the Advocate General accepts the reasoning that the Standard Contractual Clauses, as a tool, do their job to protect personal data outside the EU.

“However, it places the onus on companies and, ultimately, on regulators, to scrutinise the functioning of the contractual protections in practice."

“In essence, this means that organisations transferring data out of the EU cannot just sign the agreement and forget about it. Instead, they must ensure the importing organisation can comply with it."

“The Advocate General also seems to question the standard of data protection provided by the Privacy Shield, which appears to be held to a higher standard than the standard contractual clauses.”

The Advocate General’s Opinion is not binding on the Court of Justice. We will publish a full analysis of this Opinion by Hogan Lovells privacy team in the next issue of PL&B International Report.

See the CJEU press release.