116
It should, however, be pointed out that the powers of the competent supervisory authority are subject
to full compliance with the decision in which the Commission finds, where relevant, under the first
sentence of Article 45(1) of the GDPR, that a particular third country ensures an adequate level of
protection. In such a case, it is clear from the second sentence of Article 45(1) of that regulation, read
in conjunction with recital 103 thereof, that transfers of personal data to the third country in question
may take place without requiring any specific authorisation.
117
Under the fourth paragraph of Article 288 TFEU, a Commission adequacy decision is, in its entirety,
binding on all the Member States to which it is addressed and is therefore binding on all their organs in
so far as it finds that the third country in question ensures an adequate level of protection and has the
effect of authorising such transfers of personal data (see, by analogy, as regards Article 25(6) of
Directive 95/46, judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 51 and
the case-law cited).
118
Thus, until such time as a Commission adequacy decision is declared invalid by the Court, the
Member States and their organs, which include their independent supervisory authorities, cannot adopt
measures contrary to that decision, such as acts intended to determine with binding effect that the third
country covered by it does not ensure an adequate level of protection (judgment of 6 October 2015,
Schrems, C‑362/14, EU:C:2015:650, paragraph 52 and the case-law cited) and, as a result, to suspend
or prohibit transfers of personal data to that third country.
119
However, a Commission adequacy decision adopted pursuant to Article 45(3) of the GDPR cannot
prevent persons whose personal data has been or could be transferred to a third country from lodging a
complaint, within the meaning of Article 77(1) of the GDPR, with the competent national supervisory
authority concerning the protection of their rights and freedoms in regard to the processing of that data.
Similarly, a decision of that nature cannot eliminate or reduce the powers expressly accorded to the
national supervisory authorities by Article 8(3) of the Charter and Article 51(1) and Article 57(1)(a) of
the GDPR (see, by analogy, as regards Article 25(6) and Article 28 of Directive 95/46, judgment of
6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 53).
120
Thus, even if the Commission has adopted a Commission adequacy decision, the competent national
supervisory authority, when a complaint is lodged by a person concerning the protection of his or her
rights and freedoms in regard to the processing of personal data relating to him or her, must be able to
examine, with complete independence, whether the transfer of that data complies with the requirements
laid down by the GDPR and, where relevant, to bring an action before the national courts in order for
them, if they share the doubts of that supervisory authority as to the validity of the Commission
adequacy decision, to make a reference for a preliminary ruling for the purpose of examining its
validity (see, by analogy, as regards Article 25(6) and Article 28 of Directive 95/46, judgment of
6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraphs 57 and 65).
121
In the light of the foregoing considerations, the answer to the eighth question is that Article 58(2)(f)
and (j) of the GDPR must be interpreted as meaning that, unless there is a valid Commission adequacy
decision, the competent supervisory authority is required to suspend or prohibit a transfer of data to a
third country pursuant to standard data protection clauses adopted by the Commission, if, in the view
of that supervisory authority and in the light of all the circumstances of that transfer, those clauses are
not or cannot be complied with in that third country and the protection of the data transferred that is
required by EU law, in particular by Articles 45 and 46 of the GDPR and by the Charter, cannot be
ensured by other means, where the controller or a processor has not itself suspended or put an end to
the transfer.
The7th and 11th questions
122
By its 7th and 11th questions, which it is appropriate to consider together, the referring court seeks
clarification from the Court, in essence, on the validity of the SCC Decision in the light of Articles 7, 8
and 47 of the Charter.
123
In particular, as is clear from the wording of the seventh question and the corresponding explanations
in the request for a preliminary ruling, the referring court asks whether the SCC Decision is capable of
ensuring an adequate level of protection of the personal data transferred to third countries given that