International transfer of personal data: the Schrems II decision and its consequences

The current digital economy constantly necessitates the transfer of personal data across borders. With time, countries around the world have developed their own approach to data protection. One of the most influential legal frameworks in the field of data protection in the world undoubtedly is the European GDPR, which shows extensive extraterritorial application. This dissertation wishes to analyze the global implications of the European Commission’s adequacy decisions, with a particular focus on the consequences that the Schrems II judgement had for data transfer between the EU and the US. In the first chapter, the dissertation aims to give a brief overview of the relevance of data transfer today and an introduction to the history of the European approach to data protection. In the second chapter, the dissertation analyses the GDPR, focusing on its extraterritorial application, and in particular on Chapter V of the regulation, which is dedicated to data transfers with third countries. In the third chapter, the dissertation examines two adequacy decisions issued by the European Commission: the Japanese and the British ones, with their own strengths and vulnerabilities. Lastly, the fourth chapter discusses in great detail the transfer of personal data between the EU and the US, from the Safe Harbor agreement to the invalidation of the Privacy Shield with the Schrems II decision. The second part of the fourth chapter is dedicated to the consequences of the Schrems II decision, the DPAs’ role in enforcing the CJEU judgment, concluding with a mention to the newly drafted EU-US Data Privacy Framework.