Schrems I and Schrems II are two Court of Justice of the EU rulings that struck down the transfer frameworks the EU used for US data flows: Safe Harbour in 2015 and Privacy Shield in 2020. The practical lesson for developers is that a transfer mechanism can disappear, so you need a fallback.
What the two cases decided
The first case, C-362/14, ended with the Court declaring the Commission's US Safe Harbour decision invalid. Safe Harbour had let companies in the US self-certify and receive EU personal data.
The second case, C-311/18, ended with the Court invalidating Decision 2016/1250, the adequacy decision behind the EU US Privacy Shield. Privacy Shield was the replacement framework for Safe Harbour.
Both press releases come from the Court itself. The full reasoning sits in the judgments, and you should read those or your counsel's summary before building a legal position on them.
Why developers should care
You did not write the law, but you inherit its consequences. When a framework falls, every vendor contract that relied on it needs another basis, often on short notice. Teams that kept a map of vendors, regions and mechanisms moved quickly. Teams that did not spent weeks finding out which tools sent data where.
What stayed available
Standard contractual clauses stayed in use. The European Commission issued modernised clauses on 4 June 2021, replacing the three older sets adopted under the previous directive. Secondary commentary on Schrems II says the Court kept the clauses but expected exporters to check whether the destination country's law lets the importer honour them. Treat that point as something to confirm in the judgment text, not as a settled summary.
The pattern behind both rulings
Both cases turn on the same question: does the destination give protection that is essentially equivalent, given how public authorities can access data there? The Commission's own list of factors for adequacy in Article 45 includes national security legislation, government access, redress for individuals and independent oversight. That list is a good proxy for what a regulator or court will weigh.
What to do in your own stack
- Keep an inventory of vendors that receive EU personal data, with the country and the mechanism used.
- Store the date you last verified each mechanism.
- Prefer designs where the vendor sees less data, for example by encrypting fields before they leave your systems.
- Keep a fallback mechanism signed where you can.
- Make switching a vendor a planned operation, not an emergency.
For the current US framework, see how to check a vendor under the EU US Data Privacy Framework.
Safeguard's asset discovery and SBOM scanning can help you find which third party components and services actually run in your estate, which is the first step of a transfer inventory. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Did Schrems II end all transfers to the US?
No. It invalidated Privacy Shield, not every transfer mechanism. Other safeguards remained available, and a later framework was adopted in 2023.
Is this legal advice?
No. Confirm your position with counsel and the judgments themselves.
Sources
- Court of Justice press release on Schrems I (C-362/14)
- Court of Justice press release on Schrems II (C-311/18)
- European Commission: standard contractual clauses
- GDPR Article 45
Last reviewed: 19 October 2026.
