The Court of Justice of the European Union's judgment in Schrems II and EU-UK data transfers after Brexit

The Court of Justice of the European Union ("CJEU")'s judgment means that an EU adequacy decision for the UK is more critical than ever. If the UK does not receive an EU adequacy decision then the judgment raises question marks over the ability to transfer data from the EU to the UK in reliance on standard contractual clauses after the transition period ends.

In brief, the CJEU said today that in order to rely on standard contractual clauses, the data exporter will need to make an assessment of the legal system in the data importer's country. This is necessary to ensure that the data is protected to a standard "essentially equivalent" to that in the EU.

The test of being "essentially equivalent" is the same test as applies when the EU confers adequacy on a third country.  So the data exporter relying on standard contractual clauses will in effect need to conduct their own adequacy assessment of the third country's legal frameworks. But if the EU has already done that in relation to the UK and found the UK's systems to not to be equivalent to the EU's, then it will be difficult for an exporter intending to send data to the UK to take the opposite view. 

There may of course be ways round this, for example using other safeguards such encrypting data which is simply being stored in the UK. However, it does highlight that in the absence of an EU adequacy decision, transfers of data to the UK will not necessarily be straightforward.