Special thanks to Christian Albano for his contributions to this post
In a written opinion published in December 2019, Henrik Saugmandsgaard Øe, Advocate General to the Court of Justice of the European Union (CJEU), found that "standard contractual clauses" are valid and legal provisions for the transfer of Europeans' personal data to entities outside of the European Union.
The Advocate General's opinion stems from a challenge by Max Schrems, an Austrian privacy activist, to Facebook Ireland's transfer of his personal data to Facebook, Inc.'s servers, which are located in the United States. Facebook Ireland is a subsidiary of the U.S.-based Facebook, and is the headquarters for Facebook in the E.U.
In challenging Facebook's practices, Schrems pointed to Edward Snowden's disclosure of the operations of U.S. intelligence agencies, such as the National Security Agency (NSA), and claimed, among other things, that the law and practices of the U.S. do not adequately protect his data and the rights to privacy provided to him by the Charter of Fundamental Rights of the European Union.
Facebook Ireland asserts that the data transfer processing agreement it has with Facebook provides the legal basis for its transfer of Schrems' personal data because it contains the aforementioned "standard contractual clauses."
"Standard contractual clauses" come from a 2010 decision of the E.U.'s executive branch, the European Commission, which provided a set of provisions it found afforded sufficient safeguards to protect Europeans' fundamental privacy rights when their data is transferred abroad.
Although Advocate General Øe's decision is not binding on the CJEU, Facebook will likely view it as a step in the right direction for continuing its data transfer practices, as CJEU decisions are typically consistent with the Advocate General's recommendations. The CJEU's ultimate decision on whether "standard contractual clauses" adequately protect E.U. citizens' privacy rights will inform, and could significantly impact, companies' decisions about their data transferring processes going forward.