Module 1 · 1.4

English ▾

Nederlands English Deutsch Français Español Italiano

Schrems II, the Data Privacy Framework and the uncertainty

Module 1: Why a European cloud? · Reading time: 12 minutes

Learning objective: After this lesson, you can recount the history of agreements on data transfers from the EU to the US, explain what Schrems II decided, what the EU-US Data Privacy Framework is, and why the current framework remains uncertain.

Key concepts: transfer, adequacy decision, Safe Harbor, Schrems I, Privacy Shield, Schrems II, standard contractual clauses (SCCs), transfer impact assessment (TIA), supplementary measures, EU-US Data Privacy Framework (DPF), Executive Order 14086, Data Protection Review Court, self-certification, Latombe, PCLOB

Transfer: the rule and the exception

In lesson 1.2 you saw that data may only leave the European Economic Area (EEA) if the destination country offers an adequate level of protection, or if there are additional safeguards (GDPR Chapter V). This leaving is called a transfer. A transfer isn't just sending a file to America: if a US support employee remotely views your European environment, or if your data sits with a US service, that can also count as a transfer.

The easiest route is an adequacy decision (Art. 45): the European Commission decides that a country has a level of protection "essentially equivalent" to that of the EU. Such decisions exist for, among others, Switzerland, the United Kingdom, Japan and Canada (for commercial organisations). For the US the story is more complicated: there, the Commission has twice been overruled by the Court of Justice of the European Union (CJEU).

This is explanation, not legal advice. The state of affairs in this lesson is as of November 2026.

Bridge 1: Safe Harbor and Schrems I

In 2000, the EU and the US concluded the Safe Harbor agreement. American companies could sign up and promise to properly protect European data. The Commission issued an adequacy decision for this.

In 2013, Edward Snowden revealed how American intelligence agencies collected data from internet companies on a large scale. Austrian lawyer Max Schrems filed a complaint against Facebook in Ireland: his data went to the US and wasn't protected there. The case reached the Court of Justice of the European Union. On 6 October 2015, the Court declared the Safe Harbor decision invalid (case C-362/14, "Schrems I"). The core issue: the Commission hadn't examined whether the US government kept within limits, and Europeans had no real legal remedy.

Bridge 2: Privacy Shield and Schrems II

As early as 2016 a successor arrived: the EU-US Privacy Shield, with stricter rules and an ombudsperson at the US Department of State. Schrems took legal action again.

On 16 July 2020, the Court ruled in case C-311/18, "Schrems II". The Court declared the Privacy Shield invalid. The reasons:

American surveillance programmes, particularly under FISA Section 702 and Executive Order 12333 (lesson 1.3), weren't limited to what is "strictly necessary".
Europeans had no effective access to an independent court; the ombudsperson wasn't independent enough and couldn't take binding decisions.

The Court also said something important about the alternative, the standard contractual clauses (SCCs). These are model contracts from the Commission that the sender and the recipient sign. These remained valid, but: the party transferring the data must assess, case by case, whether the law of the receiving country undermines those commitments. If so, supplementary measures are needed, for example encryption where the recipient doesn't hold the key. If that isn't possible, the transfer must stop.

That assessment is called a transfer impact assessment (TIA). The European Data Protection Board (EDPB) wrote recommendations on this in 2021. New standard contractual clauses also arrived in 2021 (Implementing Decision (EU) 2021/914).

For a small organisation, this was difficult: how can you, as a bakery, assess US intelligence law? In practice, many relied on the contracts and documentation of the big providers.

Bridge 3: the EU-US Data Privacy Framework

The US and the EU negotiated again. President Biden signed Executive Order 14086 on 7 October 2022. Among other things, it states that intelligence work must be "necessary and proportionate", and establishes a complaints procedure with a Data Protection Review Court (DPRC) within the US Department of Justice as its final step.

On 10 July 2023, the Commission adopted the adequacy decision for the EU-US Data Privacy Framework (DPF). How it works:

It applies only to American organisations that have joined (self-certification with the US Department of Commerce). The list is on the website dataprivacyframework.gov. If a company isn't on it, the DPF doesn't apply to that company.
Compliance in the US is monitored by, among others, the Federal Trade Commission (FTC).
There is a periodic review by the Commission.

For users, the DPF means: transfer to a participating American company is once again permitted without a TIA. That's why many providers say: "We comply with the GDPR."

Why the framework remains uncertain

The DPF stands, but on shaky ground:

An Executive Order isn't a law. A future president can amend or revoke it, without Congress.
The General Court and the appeal. French member of parliament Philippe Latombe asked the General Court of the EU to annul the DPF decision. On 3 September 2025, the General Court rejected this (case T-553/23): in the General Court's view, the DPRC was independent enough. Latombe has appealed to the Court of Justice (case C-703/25 P). As of November 2026, there is no ruling yet. The Court has been stricter in Schrems I and II than the General Court is now.
Oversight in the US under pressure. In January 2025, the members of the Privacy and Civil Liberties Oversight Board (PCLOB) who had been nominated by the Democrats were dismissed; since then, that oversight body has had no quorum and can only carry out its work, including oversight of the complaints procedure, to a limited extent. On 29 June 2026, the US Supreme Court ruled in Trump v. Slaughter that the president may dismiss FTC members without cause. Legal experts point out that this sharpens the question of independent oversight, on which the DPF relies.
New proceedings. Privacy organisation noyb has announced it's considering its own case. Such a case takes years.

If the DPF falls, what happened in 2015 and 2020 will happen again: organisations will have to fall back overnight on standard contractual clauses with a TIA, or stop the transfer. No transition period has been agreed for that scenario.

What does this mean for you?

For Bakkerij De Korrel, the question isn't "is it allowed right now?", because with the DPF, it currently is. The question is: "do I want to depend on a framework that has already fallen twice and is before the Court for a third time?" A service established within the EEA that keeps the data within the EEA doesn't depend on the DPF. That isn't a legal requirement, but it is a calmer starting point.

In practice: what this looks like with a provider

Check the privacy notice or data processing agreement of your current provider to see on what basis it transfers data to the US: the DPF, standard contractual clauses, or both. Large providers often cite both, precisely to cover themselves if the DPF falls. A European provider with no transfer outside the EEA doesn't need to arrange any of this; its list of sub-processors shows whether that's actually the case (lesson 9.2). At WebOké, the data processing agreement states that transfer outside the EU is only allowed with prior written consent; with other providers you'll usually find a similar clause in an article on "transfer" or "international transfer".

Summary

Transfer outside the EEA is only allowed with an adequacy decision or with safeguards such as standard contractual clauses.
The Court declared Safe Harbor (2015, Schrems I) and the Privacy Shield (2020, Schrems II) invalid, mainly because of American surveillance and a lack of legal remedy.
Since 10 July 2023, the EU-US Data Privacy Framework applies, but only to American companies that have joined.
The DPF rests on a presidential decision and is under dispute: Latombe's appeal (C-703/25 P) is ongoing, and US oversight is under pressure.
A service that keeps data within the EEA doesn't depend on the DPF.

Quiz

1. What did the Court of Justice decide in Schrems II (16 July 2020)? That all transfer to the US is prohibited
That the GDPR doesn't apply to American companies
That Safe Harbor is valid again
That the Privacy Shield is invalid, and that standard contractual clauses can only be used if the law of the receiving country doesn't undermine the protection

The Privacy Shield fell. SCCs remained valid, but with the obligation to assess case by case whether supplementary measures are needed.

2. An American company isn't on the Data Privacy Framework list. What does that mean? Transfer to that company can't rely on the DPF; other safeguards are then needed, such as SCCs with an assessment
The DPF automatically applies to all American companies
The company isn't allowed to have European customers
The company doesn't fall under American law

The DPF works through self-certification. Only participating organisations fall under it.

3. Why do lawyers call the DPF vulnerable? Because it was never approved
Because the main safeguards are set out in a presidential decision, the appeal before the Court is ongoing, and American oversight is under pressure
Because it only applies to Switzerland
Because it was abolished in 2025

Executive Order 14086 can be amended without Congress, case C-703/25 P is ongoing, and the PCLOB and FTC are under dispute.

4. What is a transfer impact assessment (TIA)? A tax on international data traffic
A speed test of the connection to the US
An assessment of whether the law of the receiving country undermines the commitments in the standard contractual clauses, and which supplementary measures are needed
A certificate from the data centre

After Schrems II, anyone transferring data on the basis of SCCs must assess this case by case.

5. What happened for organisations when Safe Harbor and the Privacy Shield fell? There was always a two-year transition period
All American services were shut down
Nothing changed
The legal basis fell away immediately; organisations had to quickly arrange another basis or stop the transfer

An adequacy decision that's declared invalid stops applying immediately. That's why a plan B (or a service with no transfer) is sensible.

Exercise

Exercise E1.4: On what basis does your data go to the US? Look in the privacy notice or data processing agreement of your current cloud service to find out whether data is processed outside the EEA, and on what basis (DPF, SCCs, adequacy decision for another country). Check on dataprivacyframework.gov whether the company is on the list. Describe what happens for you if the DPF is annulled.

Exercise E1.4: On what basis does your data go to the US?

Read the privacy notice or data processing agreement of your service.

I know whether the service processes data outside the EEA (including remote support and sub-processors).
I know which legal basis is mentioned: DPF, standard contractual clauses, an adequacy decision for another country, or none.
I've checked whether the company is on the DPF list (dataprivacyframework.gov) and for which types of data (HR or non-HR).

What should your organisation do if the Court of Justice of the European Union declares the DPF invalid? What would stop working immediately?

Also save my answers in My courses (so you can view and download them on any device). Don't include any passwords or other secrets.

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing