EU-USのプライバシーシールドを無効にしま〜す by EU裁判所

こんにちは、丸山満彦です。

欧州司法裁判所（Court of Justice of the European Union）がEU-USのプライバシーシールド（Decision 2016/1250）を無効にするという判決を出しましたね。。。

標準契約約款 (Decision 2010/87) は使えますって。。。

● Court of Justice of the European Union (en)

・2020.07.16 No 91/2020 Judgment of the Court of Justice in Case C-311/18 Facebook Ireland and Schrems

The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield

・C-311/18 概要 ECLI:EU:C:2020:559(en) [PDF] 

The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield

However, it considers that Commission Decision 2010/87 on standard contractual clauses for the
transfer of personal data to processors established in third countries is valid.

　[HTML]にしてみました。。。

・C-311/18 判決 ECLI:EU:C:2020:559 (en) [HTML]

(Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Charter of Fundamental Rights of the European Union — Articles 7, 8 and 47 — Regulation (EU) 2016/679 — Article 2(2) — Scope — Transfers of personal data to third countries for commercial purposes — Article 45 — Commission adequacy decision — Article 46 — Transfers subject to appropriate safeguards — Article 58 — Powers of the supervisory authorities — Processing of the data transferred by the public authorities of a third country for national security purposes — Assessment of the adequacy of the level of protection in the third country — Decision 2010/87/EU — Protective standard clauses on the transfer of personal data to third countries — Suitable safeguards provided by the data controller — Validity — Implementing Decision (EU) 2016/1250 — Adequacy of the protection provided by the EU-US Privacy Shield — Validity — Complaint by a natural person whose data was transferred from the European Union to the United States)

In Case C‑311/18,

REQUEST for a preliminary ruling under Article 267 TFEU from the High Court (Ireland), made by decision of 4 May 2018, received at the Court on 9 May 2018, in the proceedings

■ 報道等

● 新華社通信
・2020.07.16 EU court rejects EU-U.S. data sharing deal

BRUSSELS, July 16 (Xinhua) -- The European Court of Justice on Thursday struck down a data sharing arrangement between the European Union (EU) and the United States, arguing that it has failed to offer enough privacy protection for Europeans against U.S. surveillance.

"The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-U.S. Data Protection Shield," the EU's top court said in a press release.

The court found that in the current arrangement of data transfer, "the requirements of U.S. national security, public interest and law enforcement have primacy, thus condoning interference with the fundamental rights of persons whose data are transferred to that third country."

● The New York Times
・2020.07.16 EU Top Court Rejects EU-U.S. Data Transfer Tool, Backs Another Tool

● EU Law Live
・2020.07.16 EU-US Privacy Shield Decision is invalid, but standard contractual clauses can in essence be used for EU-US data transfers: Court of Justice’s ruling in Facebook Ireland and Schrems

The Grand Chamber of the Court of Justice has today ruled that EU-US Privacy Shield Decision 2016/1250 is invalid, so that companies transferring large amounts of data from the EU to the US must find a new agreement to do so. However, it has upheld the validity of Decision 2010/87 establishing standard contractual clauses for certain categories of transfers of personal data to processors established in third countries – not finding it in breach the Charter of Fundamental Rights, and therefore not taking issue with the use of contractual clauses for such data transfers out of the EU to occur (Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (C-311/18)).

● The Tech Cranch
・2020.07.16 Europe’s top court strikes down flagship EU-US data transfer mechanism by Natasha Lomas

A highly anticipated ruling by Europe’s top court has just landed — striking down a flagship EU-US data flows arrangement called Privacy Shield.

“The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield,” it wrote in a press release.

● Telecoms
・2020.07.16 EU court invalidates EU-US Data Protection Shield due to US surveillance laws by Scott Bicheno

The European Court has overruled an EC decision for the second time in two days, this time concluding that US snooping means EU data isn’t safe if transferred over there.

● Arnold & Porter -BioSliceBlog
・2020.07.16 The CJEU confirms the validity of the Standard Contractual Clauses but invalidates the EU-US Privacy Shield

2020.07.19の追記です。

● Europian Data Protection Board (EDPB)
・2020.07.17 Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems

The EDPB welcomes the CJEU’s judgment, which highlights the fundamental right to privacy in the context of the transfer of personal data to third countries. The CJEU’s decision is one of great importance. The European Data Protection Board (EDPB) has taken note of the fact that the Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Privacy Shield, and of the fact that it considers Commission Decision 2010/87 on Standard Contractual Clauses (SCCs) for the transfer of personal data to processors established in third countries valid.

ということで、判決を歓迎しているようです(^^)