The European Court of Justice (ECJ) will begin hearing a case between the Irish Data Protection Commission (DPC) and Facebook over the legality of the transfer of user data between Europe and the US. The outcome of the case could have much broader implications for a range of businesses that rely on a legal mechanism called standard contractual clauses (SCCs) designed and endorsed by the European Commission for thousands of Europeans to do business worldwide. One of 11 questions relating to SCCs that the Irish High Court asks ECJ to decide on is whether provisions of EU law on national security, public security, defense, and state security apply to transfers of data outside the EU under SCCs. As the ECJ is expected to deliver judgment by the end of 2019, the EU-US Privacy Shield mechanism on which thousands of companies rely on to expedite transfers of personal data across the Atlantic looks to be at stake.
