The judgment of a case delivered on 16 July 2020 by the Court of Justice of the European Court (CJEU) also informally known as the European Court of Justice (ECJ), the supreme court of the European Union has drawn global attention.

William Maema, a Senior Attorney and Partner at global law firm DLA Piper Africa takes us through the background proceedings of the infamous ruling and what it means to data privacy and protection in a period of increasing data breach across the world.

Background to the case

The proceedings before the Court were filed by one Mr Max Schrems, an Austrian national and the parties included Governments of the United States, Germany, Ireland, Belgium, Czech Republic, The Netherlands,, France,Austria, Poland, Portugal and UK, as well as the European Parliament, European Commission, the European Data Protection Commissioner, among others.

Mr Schrems, a user of the Facebook social network since 2008, filed a complaint requesting, in essence, that Facebook Ireland Limited be prohibited from transferring his personal data to its US parent company, Facebook Inc on grounds that the law and practice in force in the US did not ensure adequate protection of the personal data held in its territory against the surveillance activities of its security agencies.

He claimed that US law requires Facebook to make the personal data transferred to it by its subsidiaries to certain governmental agencies such as the National Security Agency (NSA) and the Federal Bureau of Investigations (FBI) confidential.

He therefore sought orders to prohibit the transfer of his personal information by Facebook Ireland to the US.

The evidence before the Court showed that under US law, operators of the internet backbone are required to allow NSA to copy and filter internet traffic flows in order to acquire communication from, to or about non-US nationals.

The law also allows NSA to intercept data in transit to the US by accessing underwater cables on the floor of the Atlantic and to collect and retain such data before its arrival in the US.

The US Government admitted that it did not grant data subjects actionable rights before the courts against US authorities. US law did not, therefore, confer rights which were enforceable against security agencies through US courts.

Finally, the evidence showed that unlike in Europe where there is a well-established judicial mechanism for redressing breaches of personal data, US law did not afford EU citizens a level protection that was equivalent to that guarantees by European law.

Although the initial proceedings in this case were lodged in 2015 before the enactment of the General Data Protection Regulation (GDPR), the judgment is based on the protections granted to EU data subjects under the GDPR since it was the applicable law by the time the judgment was rendered.

The GDPR recognises that rapid technological developments and globalisation have brought about new challenges concerning the protection of personal data.

Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale.

Natural persons increasingly make personal information available publicly and globally in the ordinary course of their daily social and economic lives without paying much attention to the commercial value of such information.

While in principle the law should facilitate the free flow of personal information, the countries in which such information is shared must have adequate safeguards to ensure its protection against unlawful access and use.

The Ruling

The European apex court ruled in favour of Mr Schrems and observed that: –

  • Where personal data of persons in the EU is transferred to a country outside the EU such country must afford the data equal protection to that which is available in the EU under the GDPR and the EU Charter. The country must have appropriate safeguards, enforceable rights and effective legal remedies which are essentially equivalent to those guaranteed within the European Union;
  • Where it is proved that contractual clauses are not or cannot be complied with in the destination country, transfer of personal data to such country should be prohibited by the national data protection regulator since, by their inherently contractual nature, such clauses are not capable of being binding on the governmental authorities of that country;
  • Where the data controller or processor is unable to take adequate additional measures to guarantee the protection of the personal data, the national data protection regulator is required to suspend or prohibit the transfer of personal data to the country concerned e.g. where the law of such country imposes an obligation on the recipient of the personal information which are contrary to the safeguards available locally;
  • Where personal data has already been transferred to a country that does not provide equivalent protection, the national data regulator should order such information and all copies of it to be returned and destroyed in their entirety; and
  • Data subjects must have the possibility of bringing legal action before an independent and impartial court in the destination country for purposes of having access to their data or rectification or erasure of it. Therefore, where, like in the US, the legislation does not provide for the possibility for an individual to pursue legal remedies for breach of his personal information, transfer of data to such country should generally be refused.

My Opinion

In my point of view, the Court’s decision is correct on all the points that it dealt with. It will have far-reaching implications especially upon US multinationals whose subsidiaries across the world handle personal data belonging to data subjects outside the US.

Since most data protection laws, including the Kenyan Data Protection Act, are tailored along the GDPR model, we expect Data Protection regulators to adopt a similar interpretation to safeguard the personal information of their countries.

This will make it more difficult for personal information to be transferred outside the country, especially to the US, due to the gaps in the protections mechanisms that were identified by the CJEU in the Schrems II case.

The case is also important because it dealt with transfer of data between related entities, i.e. a company and its subsidiary through an automated system which is very common.

Multinationals will have to re-think their model of data storage. For Facebook and other social networks which have their cloud servers in the US, there may be an avalanche of claims by data subjects arising from the precedent set by the Schrems II case.

The case also lays bare the ineffectiveness of standard contractual clauses which purport to give the data subject a false sense of protection while in actual fact their data is available for inspection by third parties including governmental, agencies.

Facebook Ireland Ltd had argued that there was no breach since its parent company was bound by contractual clauses to safeguard the personal information of the data subjects, but the Court found that snooping governmental authorities were not bound by such clauses.

The Court’s decision will have a significant negative impact on e-commerce which, by definition, is borderless. Data is the new oil, without which, modern businesses cannot operate efficiently and profitably.

Free movement of personal information across different markets and geographies is essential. When this is hampered especially in relation to a significant market like the US, international trade is likely to suffer.

The decision deals a heavy blow to providers of cloud data storage services which are also borderless. Since the US is unlikely to relax its security laws because of the Schrems II decision many US cloud service providers may have to re-locate their servers to Europe which, thanks to the GDPR, has the most developed data legislation in the world. This is an expensive and disruptive undertaking.

The decision will also jolt countries across the world to enact data protection laws which are compliant with the principles of the GDPR.

This judgment may therefore end up being the much-awaited catalyst for a global wave of enacting and harmonising data protection laws along the GDPR model.

What the case means to Kenya and the world

Kenya enacted its first data protection law in 2019. The Data Protection Act (“DPA”) has not been fully operationalised owing primarily to an absence of the institutional framework necessary to implement the provisions of the Act. In the circumstances, Kenya at present has no relevant jurisprudence on the Act and its provisions.

However, since the DPA is modelled along the GDPR principles, the CJEU’s interpretation of the GDPR in the Schrems II case will have a substantial influence on the interpretation of the DPA by the Data Protection Commission and Kenyan courts.

Although the fines and penalties stipulated in the DPA are not as high, they are likely to cause sufficient financial and reputation damage to organisations which fail to observe the provisions of the DPA.

The EU is the undisputable gold standard in data protection and we expect all courts in the world conform to its precedents.

The most important consideration for any organisation in the world handling large-scale personal data is to ensure that such data is processed in strict compliance with the GDPR.

Since the GDPR was enacted a couple of years ago, many businesses across the world including Google, Marriot Hotel, British Airways, among others, have suffered huge fines and penalties due to data breach.


author

79 Comments

  • DavidLal, July 7, 2021 @ 9:29 pm

    http://ivermectinstr.online# ivermectin tablets order

  • DavidLal, July 8, 2021 @ 11:54 am

  • BrendanLat, July 11, 2021 @ 6:00 am

    ed in men: otc ed pills – erectal disfunction

  • PeterLiero, July 17, 2021 @ 5:19 am

    viagra from canada viagra pills – viagra price

  • PeterLiero, July 18, 2021 @ 7:01 pm

    viagra online usa blue pill viagra – buying viagra online

  • WayneSoowl, July 20, 2021 @ 2:49 am

    safe buy cialis buy cialis very cheap prices fast delivery – buy cialis in miami

  • Mariojendy, July 25, 2021 @ 4:09 pm

    lasix online buy lasix – lasix side effects

  • Mariojendy, July 27, 2021 @ 5:38 am

    buy generic plaquenil plaquenil purchase – hydroxychloroquine 30 mg

  • WilliamRab, July 30, 2021 @ 6:24 pm

    free adult dating sites
    [url=”http://onlinedatinglook.com/?”]elite dating site[/url]

  • WilliamCof, July 31, 2021 @ 1:59 pm

    cialis ireland cialis online canadian pharmacy – cialis generic online uk

  • RonaldMog, August 2, 2021 @ 10:22 am

    viagra story buy viagra online in melbourne – canadian viagra pharmacy

  • gay dating over 50 in sc, August 2, 2021 @ 11:11 pm

    Thanks a lot for sharing your nice site. https://gaydatingzz.com/

  • RonaldMog, August 4, 2021 @ 2:01 am

    how much does viagra cost at walmart? viagra side effects blood pressure – cialis and viagra mix

  • RonaldMog, August 6, 2021 @ 8:43 pm

    generic viagra australia buy paiement cod viagra vvgipys – viagra jelly sachet

  • 1000 calorie keto diet, August 7, 2021 @ 2:59 pm

  • RonaldMog, August 8, 2021 @ 8:00 pm

    viagra professional australia viagra onlines – pfizer viagra india

  • KevinCon, August 9, 2021 @ 2:56 am

    free gay male dating
    gay dating groups
    [url=”http://gaychatus.com?”]gay dating london england[/url]

  • gay dating in netherland, August 9, 2021 @ 3:40 pm

    best gay dating most variety https://freegaychatnew.com/

  • gay married dating, August 9, 2021 @ 9:16 pm

    gay dating site vgl https://gaychatgay.com/

  • gay dating directory, August 10, 2021 @ 10:31 pm

    gay asexual dating https://gaychatus.com/

  • KevinCon, August 13, 2021 @ 4:56 am

    gay furry dating ga,es
    florida gay dating
    [url=”http://gaychatgay.com?”]gay asexual dating site[/url]

  • Floydhib, August 13, 2021 @ 4:38 pm

    where to buy amoxicillin 500mg amoxicillin cephalexin – amoxicillin where to get

  • Joshualap, August 14, 2021 @ 1:19 am

    canadadrugpharmacy.com
    viagra online shop best generic cialis pharma from canada generic brand viagra [url=http://visnyk.hoippo.km.ua/user/painthood49/]viagra in canada[/url] canada viagra generic cialis daily canada viagra wikipedia medication prices [url=https://www.daoduytu.edu.vn/forum/links.php?url=https://bbs.pku.edu.cn/v2/jump-to.php?url=https://dryerstool12.webgarden.cz/rubriky/dryerstool12-s-blog/just-how-to-purchase-canadian]buy viagra online without a prescription[/url]
    meds canada canada pharmacy for viagra cialis no prescription cialis without prescription [url=http://drmovie.ru/user/modemreward49/]canada drugs[/url]

  • Barrycliex, August 15, 2021 @ 2:03 am

    canadian medication
    canadian.cialis pharmacy rx one canadian meds viagra canadian pharmacy.com [url=https://fkwiki.win/wiki/Post:How_To_Order_As_Well_As_Use_Your_Common_Cialis_Online_Without_Prescription]viagra from india[/url] how to get viagra buy canadian drugs without prescription viagra online order best price for viagra [url=https://ong.ng/user/profile/223061]canadian pharmacies without a prescription[/url]
    viagra in canada viagra samples free online drug cheap canadian drugs [url=http://ask.bacagadget.com/index.php?qa=user&qa_1=frowndrink45]the canada pharmacy[/url]

  • Ronaldgop, August 15, 2021 @ 11:40 pm

    stromectol price in india best price on ivermectin pills – ivermectin 3mg tablets price

  • KevinCon, August 16, 2021 @ 2:48 am

    craigslist gay dating
    gay dating boston ma
    [url=”http://gaychatgay.com?”]agoraphobic gay dating[/url]

  • Thomasonemi, August 21, 2021 @ 9:54 pm

    ivermectin 10 mg buy stromectol – ivermectin 3mg tablets price

  • Stevenhal, August 22, 2021 @ 1:27 pm

    canadian online pharmacy for viagra
    calais pills from canada cialis at canadian pharmacy viagra without a prescription 44-466 green pill [url=https://firsturl.de/hHm4A6w]canada for viagra[/url] generic viagra pills cheap viagra in canada medication canada buy cialis from canada [url=https://www.goodreads.com/user/show/138423555-kent]viagra for sale[/url]
    canada online pharmacies viagra sildenafil cialis- canadian pharmacy viamedic.com [url=https://humanlove.stream/wiki/Maximize_Your_Elegance_Regimen_With_These_Tips]viagra canada with prescription[/url]

  • Rogerseday, August 22, 2021 @ 10:55 pm

    online pharmacy medications
    sildenafil generic soft viagra viamedic com viagra.com canada [url=http://whatthehellamiagreeingto.com/index.php?title=Maximize_Your_Beauty_Routine_With_These_Tips]viagra canada pharmacy[/url] natural viagra substitute cheapest viagra online canadian generic viagra india pharmacy viagra [url=http://www.taban-miniatures.com/forum/member.php?action=profile&uid=310606]viagra buy online[/url]
    cialis in canada cost of viagra walmart medication list viagra dosages [url=https://www.princeclassified.com/user/profile/200109]viagra sales[/url]

  • GerardoSoash, August 25, 2021 @ 8:17 am

    where can i buy clomiphene clomid for sale – clomid for sale

  • gaychatrooms.org, August 28, 2021 @ 9:58 am

    Many thanks, this website is very beneficial. http://gaychatrooms.org/

  • Power to Choose energy, August 29, 2021 @ 1:13 am

    731022 843080I surely didnt comprehend that. Learnt a thing new today! Thanks for that. 68986

  • GerardoSoash, August 29, 2021 @ 5:34 am

    cialis suppliers buy 36 hour cialis without prescription – cialis online safe

  • MauriceItelf, September 2, 2021 @ 11:36 am

    propecia 5mg sale propecia generic – buy propecia cheap online

  • Patrickeneme, September 4, 2021 @ 7:20 am

    american indian dating gay
    free gay dating chat rooms uk
    [url=”http://freegaychatnew.com?”]gay black asian dating[/url]

  • MauriceItelf, September 4, 2021 @ 5:06 pm

    buy stromectol pills ivermectin for humans – stromectol for sale

  • buy finasteride in singapore, September 4, 2021 @ 7:13 pm

    Cialis 20 Ohne Rezept

  • prainue, September 4, 2021 @ 7:58 pm

  • https://ivermectinmeds.com/, September 5, 2021 @ 3:47 pm

  • oxittet, September 5, 2021 @ 8:33 pm

  • cost of lasix, September 6, 2021 @ 1:23 pm

    furosemide 40 mg cost furosemide 20 mg tablet price phode Oxire

  • Expifsvix, September 7, 2021 @ 3:20 am

    http://buystromectolon.com/ – ivermectine buy

  • order lasix online, September 8, 2021 @ 9:29 am

    furosemide cost without insurance order lasix phode Oxire

  • Terrylib, September 8, 2021 @ 11:21 am

    ed treatment drugs blue pill from canada – online medication

  • interracial adult dating gay, September 8, 2021 @ 1:07 pm

    adam4adam.com gay dating site https://gaydatinglosangeles.com/

  • viagra cut in half, September 8, 2021 @ 9:34 pm

    Cialis Forma Farmaceutica

  • furosemide generic, September 8, 2021 @ 9:40 pm

    lasix 500 mg online furosemide 40 phode Oxire

  • Henrysnalf, September 9, 2021 @ 8:44 am

    gay latino dating
    surge gay dating reddit
    [url=”http://gaydatingcanada.com?”]gay dating site santa cruz[/url]

  • gay latino thug dating, September 9, 2021 @ 11:06 am

    dating in modern gay culture https://gaydatingcanada.com/

  • lasix 40, September 9, 2021 @ 12:33 pm

    furosemide cost lasix online phode Oxire

  • single gay dads dating, September 9, 2021 @ 1:45 pm

    gay reality dating show https://dating-gaym.com/

  • Terrylib, September 9, 2021 @ 11:18 pm

    ed prescription drugs best online pharmacies in canada – comparison of ed drugs

  • most popular gay dating sites, September 10, 2021 @ 5:34 pm

    mature gay dating sites https://datinggayservices.com/

  • adam4adam gay dating login, September 10, 2021 @ 10:26 pm

    gay dating sims steam https://gayedating.com/

  • dating transwomen gay or, September 10, 2021 @ 11:17 pm

    mister gay dating site https://gayonlinedating.net/

  • megaphone gay dating, September 11, 2021 @ 4:53 am

    tips on dating a gay bear https://gay-singles-dating.com/

  • furosemide for sale, September 11, 2021 @ 3:50 pm

    furosemide online furosemide cost cvs phode Oxire

  • soypole, September 11, 2021 @ 11:20 pm

  • HiveVenue, September 11, 2021 @ 11:40 pm

  • Terrylib, September 13, 2021 @ 7:41 pm

    ivermectin generic cream ivermectin – ivermectin price comparison

  • Henrysnalf, September 14, 2021 @ 2:14 am

    sacramento gay dating sites
    st louis gay dating
    [url=”http://gayonlinedating.net/?”]black gay dating site[/url]

  • ivermectin price canada, September 14, 2021 @ 6:37 pm

    ivermectin over the counter canada buy ivermectin nz

  • SweaRse, September 14, 2021 @ 8:49 pm

  • กล่องอาหาร, September 16, 2021 @ 8:47 pm

    132948 62814I truly appreciated this amazing weblog. Make positive you keep up the great function. All of the greatest !!!! 926301

  • ivermectin 400 mg brands, September 16, 2021 @ 10:38 pm

    buy ivermectin cream buy ivermectin nz

  • Plaquenil, September 17, 2021 @ 3:19 pm

    Kmj Radio Ads Viagra

  • Priligy, September 18, 2021 @ 6:57 am

    Order Zoloft Without Script

  • ivermectin cost uk, September 18, 2021 @ 8:21 pm

    ivermectin usa price stromectol tablets buy online

  • buy z pack, September 18, 2021 @ 11:17 pm

    Amoxil Drops

  • stromectol canada, September 19, 2021 @ 12:54 pm

    ivermectin canada stromectol tablets

  • tupssirub, September 19, 2021 @ 2:11 pm

  • IrredyJem, September 20, 2021 @ 1:17 am

  • Guifand, September 20, 2021 @ 2:34 pm

  • thaccedge, September 21, 2021 @ 3:07 pm

    http://buypriligyhop.com/ – priligy cost

  • Updapse, September 22, 2021 @ 8:28 am

  • clomid without doctor supervision, September 22, 2021 @ 6:49 pm

    clomiphene for sale phode Oxire

  • buy clomid without a prescription, September 23, 2021 @ 11:20 am

    clomid online shop phode Oxire

  • Peterdax, September 24, 2021 @ 12:09 am

    plaquenil malaria plaquenil 200 mg oral tablet – plaquenil depression

  • clomid 100mg tablet price, September 24, 2021 @ 2:17 pm

Leave a Reply

Your email address will not be published.