Schrems II and the EU-US Data Privacy Framework

Schrems II is the judgment of the Court of Justice of the European Union of 16 July 2020 (case C-311/18) that invalidated the EU-US Privacy Shield. Since then, transfers of personal data to the US have relied on standard contractual clauses with a case-by-case assessment and, since July 2023, on the EU-US Data Privacy Framework for certified companies.

What is Schrems II?

Schrems II is the common name for the judgment of the Court of Justice of the European Union (CJEU) of 16 July 2020 in case C-311/18. It goes back to a complaint by the Austrian privacy activist Max Schrems about the transfer of his Facebook data to the US.

The court reached two conclusions:

  • The EU-US Privacy Shield was invalid. US surveillance laws gave authorities access to data of EU citizens without adequate limits or effective legal remedies.
  • Standard contractual clauses (SCCs) remained valid, but not as a formality. Exporters must assess, case by case, whether the law in the destination country allows the clauses to be honoured, and add supplementary measures where needed.

The name “Schrems II” is a reminder that this was not the first time: in 2015, the same court had already struck down the predecessor arrangement, Safe Harbor, in Schrems I.

The EU-US Data Privacy Framework

On 10 July 2023, the European Commission adopted a new adequacy decision for the EU-US Data Privacy Framework (DPF). US companies that certify under the framework can receive personal data from the EU without SCCs. The US introduced new safeguards for this, including limits on intelligence access and a redress mechanism for EU individuals.

The UK followed with its own extension, often called the UK-US data bridge, which has applied since 12 October 2023. Transfers from the UK to certified US companies can rely on it.

Whether the framework will hold is an open question. Privacy advocates have announced challenges, and a “Schrems III” ruling is regularly discussed. For businesses, that means: the DPF makes US transfers easier today, but it is wise not to build everything on it.

What it means for your business

Every time a tool you use stores or processes customer data in the US, you have a third-country transfer to document. In practice:

  • Check certification: is the US provider listed under the Data Privacy Framework? If so, the transfer can rely on the adequacy decision.
  • Otherwise: SCCs plus an assessment of the transfer and any supplementary measures, such as encryption.
  • Document it in your records of processing activities and your data processing agreements.

The pragmatic answer for many SMBs is EU hosting: data that is stored and processed in the EU does not need a transfer mechanism at all. See data residency. For messaging, there is one important limit: WhatsApp, Instagram and Messenger are Meta services. Meta processes these messages under its own terms, including in the US, and relies on the Data Privacy Framework and SCCs for those transfers. Channels that do not involve Meta, such as email, SMS, live chat, Telegram and Browser Push, do not raise this particular question.

Example: an insurance broker in Frankfurt

An insurance brokerage in Frankfurt had been using a US-based chat tool for customer enquiries. After Schrems II, its data protection advisor flagged the tool: data stored in the US, no clear transfer documentation. The brokerage switched to an EU-hosted messaging platform.

The result was not that the transfer question disappeared completely, but that it got much smaller. The platform itself, the conversation history and the contact data are hosted in the EU. What remains is the WhatsApp channel, where Meta processes messages under the Data Privacy Framework and SCCs. The brokerage documents that one point in its records, informs customers in its privacy notice, and offers email and live chat as alternatives for customers who prefer them.

Schrems II and SendSeven

  • Hosted in the EU (Frankfurt, Google Cloud). Platform, database and the optional AI run in European data centres.
  • AI off by default, and your data is never used for model training.
  • Encrypted in transit (TLS) and at rest.
  • A DPA under Article 28 documents the processing relationship.

For WhatsApp, Instagram and Messenger, Meta’s own processing applies as described above. More in GDPR-compliant messaging and technical and organisational measures.

This is general information, not legal advice. Check the details with your data protection lead or compliance consultant.