Schrems II Guidance Highlights US Surveillance Risks in EU Data Transfers

The Court of Justice of the European Union’s Schrems II judgment invalidated the EU–US Privacy Shield in July 2020, prompting privacy organization noyb to publish guidance for individuals and companies on transfers exposed to US surveillance laws. Noyb provided templates for information requests, transfer-suspension requests and complaints to data protection authorities. Its guidance argued that Standard Contractual Clauses cannot resolve conflicting surveillance obligations and urged organizations to assess recipients, subcontractors and interception risks. It distinguished discretionary outsourcing from certain necessary transfers or transfers based on explicit, informed consent. These materials describe the judgment-era legal position, not the current legality of any particular transfer.

Provider transparency reports illustrate the government-access issues underlying those concerns without documenting a breach. Cloudflare reported 78 US court orders and three search warrants for July–December 2019, while stating it had never surrendered encryption or authentication keys or weakened encryption at a third party’s request. Apple reported 31,778 government device requests and 6,480 account requests worldwide in the first half of 2019, providing data in 82% and 85% of cases, respectively. Amazon described different disclosure requirements for subpoenas, warrants and national-security demands; Dropbox highlighted legal restrictions on reporting national-security requests and notifying affected users. For security and privacy teams, the combined lesson is to assess transfer mechanisms alongside providers’ disclosure obligations, encryption capabilities and notification limits—not treat transparency commitments alone as proof of lawful transfers.