Summary
Schrems II is the 2020 judgment of the Court of Justice of the European Union (case C-311/18). It invalidated the EU–US Privacy Shield framework and substantially tightened the conditions under which personal data may be transferred outside the EU.
What is Schrems II?
The case, brought by Austrian lawyer Max Schrems, examined whether US legal frameworks gave EU citizens enough protection against US government surveillance once their data crossed the Atlantic. The court ruled they did not, struck down the Privacy Shield, and held that controllers relying on Standard Contractual Clauses (SCCs) must perform a Transfer Impact Assessment for every third-country transfer and add supplementary technical or organisational measures if the destination country falls short of EU standards.
In practice, Schrems II forced every EU organisation to look at their cloud and SaaS suppliers more carefully. Where is the data processed? Where do administrators sit? Does the provider have a parent company subject to extraterritorial laws like the US CLOUD Act? Many organisations responded by adding encryption with EU-held keys, by switching to EU-based providers, or by moving workloads to self-hosted, on-premises, or sovereign-cloud deployments.
The 2023 EU–US Data Privacy Framework partially restored a legal basis for transfers, but the underlying Schrems II reasoning still shapes vendor selection. Decisions about identity providers, mesh VPN management planes, and SIEM data residency are typically made with Schrems II in mind.
Why is Schrems II relevant?
- Vendor due diligence: Forces explicit assessment of cross-border data flows
- Driver of sovereignty: Strong argument for EU-based and self-hosted alternatives
- Audit topic: Regulators and auditors expect documented Transfer Impact Assessments
- Architectural impact: Often determines where control planes and key material are placed
Related Terms
- GDPR: The data-protection regulation Schrems II interprets
- CLOUD Act: US law cited as the core risk factor in Schrems II analyses
- NIS2 Directive: Newer EU regulation that intersects with Schrems II in supply-chain reviews
- DORA: Financial-sector regulation that also drives sovereignty considerations