Christmas isn’t coming early this year. 

A quick glance at the CJEU’s website will disappoint thousands of excited data protection aficionados who’ve been waiting for some certainty about protecting the transfer of personal data overseas.

Alas, they’ll have to wait another week as the long-awaited ‘Schrems 2.0’ opinion has been put back until 19 December.

So how will it affect you?

The case is principally about the degree of sharing of personal data between US companies and US intelligence agencies and whether the two key mechanisms which legitimise the transfer of personal data to countries outside the EEA offer sufficient protection, namely: 

  • standard contractual clauses (‘SCC’s or ‘model causes’), and
  • the Privacy Shield (ie, for transfers to the US).

These mechanisms play a major role in oiling the engine of the world economy by keeping data flowing. 

The fear is that the Schrems case may well put a brake on these flows by invalidating SCCs or the Privacy Shield, or even both. 

A high-ranking official in the European Commission is reported to have warned the audience at a recent IAPP privacy conference that the Schrems decision could also ‘affect’ another mechanism, namely binding corporate rules (BCRs), which many multinationals use to move personal data around their groups of companies. It’s not clear what this means at this point as BCRs are not directly under scrutiny.

So what happens if the SCCs are invalidated? Or the Privacy Shield, like the Safe Harbor before? 

Alternative safeguards like BCRs will need to be considered until the European Commission produces compliant contractual methods or certification schemes or codes of conduct are approved.

As for BCRs, the general view is that these will become even more important for certain organisations, although they're not a one-size-fits-all solution. 

The key point for now is that businesses shouldn’t panic.

The 19 December initial opinion by Advocate-General Saugmandsgaard Øe’s won't be a binding verdict. That said, it is typically more likely than not that the Court will follow his opinion. 

The upshot? In a week or so—all being well—we’ll know much more about what options are available. 

The full binding judgment is likely to come out in the first half of 2020 so businesses will have until then to work out what to do.